dashboard: forge-linked config + approval card + 3-way diff base

- forge nix option moves to hyperhive.forge.enable, defaults true;
  hive-c0re imports the forge module so it's on by default.
- drop the agent.nix container-row viewer + /api/agent-config; link
  to the agent-configs forge repo instead.
- restructure pending approvals into a card (identity header /
  what-changed body / decision actions) with a link to the proposal
  commit on the forge.
- diff opens in the side panel with a 3-way base toggle: vs applied
  (running) / vs last-approved / vs previous proposal, served by the
  new /api/approval-diff/{id}?base= endpoint.

nix/modules/hive-c0re.nix

@@ -12,6 +12,11 @@ let
   cfg = config.services.hive-c0re;
 in
 {
+  # The forge is part of the standard install — hive-c0re mirrors
+  # every agent's applied config repo into it. On by default; opt out
+  # with `hyperhive.forge.enable = false`.
+  imports = [ ./hive-forge.nix ];
+
   options.services.hive-c0re = {
     enable = lib.mkEnableOption "hive-c0re — hyperhive coordinator daemon";
     package = lib.mkOption {

nix/modules/hive-forge.nix

@@ -5,7 +5,7 @@
   ...
 }:
 let
-  cfg = config.services.hive-forge;
+  cfg = config.hyperhive.forge;
 in
 {
   # Private Forgejo for hyperhive agents, wrapped in a nixos-container
@@ -24,8 +24,18 @@ in
   # and survives container restart / host reboot. To wipe, destroy the
   # container.
 
-  options.services.hive-forge = {
-    enable = lib.mkEnableOption "hive-forge — private Forgejo (in a nixos-container) for hyperhive agents";
+  options.hyperhive.forge = {
+    enable = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = ''
+        Run hive-forge — a private Forgejo (in a nixos-container) for
+        hyperhive agents. On by default: hive-c0re mirrors every
+        agent's applied config repo into the forge's `agent-configs`
+        org, so the forge is part of the standard install. Set
+        `hyperhive.forge.enable = false` to opt out.
+      '';
+    };
 
     httpPort = lib.mkOption {
       type = lib.types.port;