feat(#2072): auto-seed Forgejo pull-mirrors (DEFAULT_ACTIONS_URL=self for CI)

General-purpose mirror mechanism for the internal forge, per mara's call on
#2074 (real Forgejo pull-mirrors, nix-configured — not a pushed clone).

- services.hyperhive.forge.mirrors: list of { upstream, dest } pull-mirrors,
  any repo. Each is created as a real Forgejo pull-mirror (re-syncs from
  upstream), dest = <owner>/<repo> in its own org.
- When forge.ci.enable is set: an actions/checkout mirror is auto-appended +
  forgejo DEFAULT_ACTIONS_URL is pointed at this instance, so CI
  'uses: actions/checkout@vN' resolves on loopback — immune to a host-resolver
  blip that previously reded every checkout (the seed/re-sync needs external
  DNS, but that's off the CI critical path).
- forgejo-seed-mirrors.service: host-side oneshot (the core admin token never
  enters a container), modelled on hive-ci-prefetch — waits <=60s for the core
  token, then idempotently ensures each dest org + creates the pull-mirror via
  the migrate API. partOf the forge container so it re-ensures on restart.
- assertions: dest must be <owner>/<repo>; mirror orgs can't shadow the
  c0re-managed namespaces (config/shared/agents/core) so the seed never races
  hive-c0re's own provisioning.

Supersedes #2074 (the raw-clone stopgap) as the durable #2072 fix.

nix/modules/hive-forge.nix

@@ -46,6 +46,82 @@ let
     dest = "actions/checkout";
   };
   effectiveMirrors = cfg.mirrors ++ lib.optional ciEnabled actionCheckoutMirror;
+
+  # Host-side core admin token hive-c0re mints after provisioning the forge
+  # admin (same file hive-ci-prefetch reads). Root-only; never enters a
+  # container — so the mirror seed runs host-side, exactly like
+  # hive-ci-prefetch, rather than minting a second token in-container.
+  coreTokenPath = "/var/lib/hyperhive/forge-core-token";
+
+  # Idempotently create each `effectiveMirrors` entry as a real Forgejo
+  # pull-mirror via the migrate API. Host-side: only talks to the forge on
+  # loopback (forgejo itself does the upstream clone, so the upstream-DNS
+  # dependency lives in the container + is off the CI critical path).
+  # Modelled on hive-ci-prefetch's wait-for-core-token loop.
+  seedMirrorsScript = pkgs.writeShellScript "forgejo-seed-mirrors" ''
+    set -uo pipefail
+    FORGE_URL="http://127.0.0.1:${toString cfg.httpPort}"
+
+    CORE_TOKEN=""
+    for i in $(seq 1 60); do
+      if [ -f "${coreTokenPath}" ]; then CORE_TOKEN=$(cat "${coreTokenPath}"); break; fi
+      echo "forgejo-seed-mirrors: waiting for core token ($i/60)..." >&2
+      sleep 1
+    done
+    if [ -z "''${CORE_TOKEN:-}" ]; then
+      echo "forgejo-seed-mirrors: core token absent after 60s — cannot seed mirrors" >&2
+      exit 1
+    fi
+    AUTH="Authorization: token $CORE_TOKEN"
+    rc=0
+
+    seed_one() {
+      upstream="$1"; owner="$2"; repo="$3"
+      # Ensure the dest org (idempotent: 201 created / 422 already exists).
+      ohttp=$(${pkgs.curl}/bin/curl -s -o /dev/null -w '%{http_code}' -X POST \
+        -H "$AUTH" -H 'Content-Type: application/json' \
+        "$FORGE_URL/api/v1/orgs" -d "{\"username\":\"$owner\"}" || echo 000)
+      case "$ohttp" in
+        201 | 422) ;;
+        *) echo "forgejo-seed-mirrors: ensure org '$owner' returned HTTP $ohttp" >&2 ;;
+      esac
+      # Skip if the repo already exists (the mirror persists across reboots
+      # in the non-ephemeral forge state, so this no-ops on every reboot
+      # after the first).
+      rhttp=$(${pkgs.curl}/bin/curl -s -o /dev/null -w '%{http_code}' \
+        -H "$AUTH" "$FORGE_URL/api/v1/repos/$owner/$repo" || echo 000)
+      if [ "$rhttp" = 200 ]; then
+        echo "forgejo-seed-mirrors: $owner/$repo already present — skipping" >&2
+        return 0
+      fi
+      # Create the pull-mirror. service=git → generic git clone of
+      # clone_addr (no upstream API token needed); mirror=true → forgejo
+      # keeps it re-syncing on its mirror interval.
+      resp=$(${pkgs.curl}/bin/curl -s -w $'\n%{http_code}' -X POST \
+        -H "$AUTH" -H 'Content-Type: application/json' \
+        "$FORGE_URL/api/v1/repos/migrate" \
+        -d "{\"clone_addr\":\"$upstream\",\"repo_owner\":\"$owner\",\"repo_name\":\"$repo\",\"mirror\":true,\"service\":\"git\",\"private\":false}" \
+        || printf '\n000')
+      mhttp=$(printf '%s' "$resp" | tail -n1)
+      case "$mhttp" in
+        2*) echo "forgejo-seed-mirrors: created pull-mirror $owner/$repo from $upstream" >&2 ;;
+        *)
+          echo "forgejo-seed-mirrors: migrate $owner/$repo failed HTTP $mhttp: $(printf '%s' "$resp" | sed '$d')" >&2
+          rc=1
+          ;;
+      esac
+    }
+
+    ${lib.concatMapStringsSep "\n" (
+      m:
+      let
+        parts = lib.splitString "/" m.dest;
+      in
+      "seed_one ${lib.escapeShellArg m.upstream} ${lib.escapeShellArg (builtins.elemAt parts 0)} ${lib.escapeShellArg (builtins.elemAt parts 1)}"
+    ) effectiveMirrors}
+
+    exit $rc
+  '';
 in
 {
   # Private Forgejo in a `hive-forge` nixos-container, shared host
@@ -262,6 +338,37 @@ in
           hostname like "forge.example.com" or "git.internal".
         '';
       }
+      {
+        # Each mirror dest must be exactly `<owner>/<repo>` — the seed
+        # splits on the single slash to create the org + repo.
+        assertion = lib.all (m: lib.length (lib.splitString "/" m.dest) == 2) effectiveMirrors;
+        message = ''
+          Every services.hyperhive.forge.mirrors[].dest must be exactly
+          "<owner>/<repo>" (one slash). Got: ${
+            lib.concatMapStringsSep ", " (m: m.dest) effectiveMirrors
+          }
+        '';
+      }
+      {
+        # Keep mirror orgs out of the hive-c0re-managed namespaces
+        # (config/shared/agents/core) so the seed never races / collides
+        # with hive-c0re's own startup provisioning of those orgs.
+        assertion = lib.all (
+          m:
+          !(lib.elem (builtins.elemAt (lib.splitString "/" m.dest) 0) [
+            "config"
+            "shared"
+            "agents"
+            "core"
+          ])
+        ) effectiveMirrors;
+        message = ''
+          services.hyperhive.forge.mirrors[].dest must not place a mirror
+          in a hive-c0re-managed org (config / shared / agents / core) —
+          those are provisioned by hive-c0re and a mirror there would
+          collide. Use a dedicated org (e.g. "actions/checkout").
+        '';
+      }
     ];
 
     containers.hive-forge = {
@@ -474,5 +581,27 @@ in
         cfg.sshPort
       ];
     };
+
+    # Seed the configured pull-mirrors once the forge + core token are up.
+    # Host-side (the core admin token never enters a container) and modelled
+    # on hive-ci-prefetch. partOf the forge container so it re-runs (and
+    # re-ensures, idempotently) on every forge (re)start. Only present when
+    # there's something to seed.
+    systemd.services.forgejo-seed-mirrors = lib.mkIf (effectiveMirrors != [ ]) {
+      description = "Seed Forgejo pull-mirrors (host-side)";
+      after = [
+        "hive-c0re.service"
+        "container@hive-forge.service"
+      ];
+      wants = [ "container@hive-forge.service" ];
+      wantedBy = [ "multi-user.target" ];
+      partOf = [ "container@hive-forge.service" ];
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+        ExecStart = seedMirrorsScript;
+        SyslogIdentifier = "forgejo-seed-mirrors";
+      };
+    };
   };
 }