glue: forge's controller-dependent settings move out of the forge module

nix/host-modules/glue-forge-controller.nix

@@ -0,0 +1,29 @@
+# Glue: wire the forge and the swarm-controller together when one host runs both.
+#
+# ONE PAIRING PER FILE — forge ← swarm-controller, and nothing else. Deleting
+# this leaves the controller seeding no pull-mirrors and the forge resolving
+# workflow actions from `data.forgejo.org`.
+#
+# ⚠️ Gated on BOTH services being here: the mirrors reach a controller on this
+# host only, and the forge's own `config` block hangs off
+# `deploy.forgejo.enable`. The forge's `mirrors` warning covers the split case.
+{
+  lib,
+  config,
+  ...
+}:
+let
+  deployCfg = config.services.hyperhive.deploy;
+in
+{
+  config = lib.mkIf (deployCfg.forgejo.enable && deployCfg.swarm-controller.enable) {
+    # The controller seeds the `actions/*` mirrors, so a forge beside one can
+    # resolve actions from itself. `mkDefault`: an operator's explicit value wins.
+    services.hyperhive.deploy.forgejo.actionsFromSelf = lib.mkDefault true;
+
+    # JSON-encoded list of { upstream, dest }, seeded by the controller's
+    # forge-objects pass (`swarm-controller/src/forge/objects.rs`).
+    systemd.services.swarm-controller.environment.SWARM_CONTROLLER_FORGE_MIRRORS =
+      builtins.toJSON deployCfg.forgejo.effectiveMirrors;
+  };
+}