docs: refresh for the dashboard rework + recent harness commits

- web-ui.md: side panel, approval card + 3-way diff base, stats
  page, forge config links, removed agent.nix viewer, per-agent
  loose-ends inline answer.
- approvals.md: forge mirror section + diff base toggle.
- turn-loop.md: recv(max), get_logs, remind, loose-ends, whoami.
- agent.md / manager.md prompts: recv(max), remind, get_logs.
- CLAUDE.md: forge.rs / stats.rs / hive-forge.nix in the file
  map, scratchpad refresh.

also: forgejo migrations.ALLOW_LOCALNETWORKS = true so an in-hive
mirror of the hyperhive repo can import from a localhost source.

CLAUDE.md

@@ -7,6 +7,8 @@ scratchpad.
 
 - High-level project intro: **[README.md](README.md)**.
 - Open work + backlog: **[TODO.md](TODO.md)**.
+- Deployment / ops / boundaries / gateway backlog:
+  **[TODO-ops.md](TODO-ops.md)**.
 
 ## File map
 
@@ -69,6 +71,10 @@ hive-c0re/         host daemon + CLI (one binary, subcommand-dispatched)
                          prepare/finalize/abort, lock_update_*
   src/migrate.rs        startup auto-migration from pre-meta layout
                          (idempotent, marker-guarded phase 4)
+  src/forge.rs          optional Forgejo wiring: per-agent users +
+                         tokens, the `agent-configs` org, and
+                         `push_config` — mirrors each applied repo
+                         into `agent-configs/<n>` on the local forge
   src/dashboard.rs      axum HTTP: static shell + /api/state JSON + actions
                          + journald viewer + bind-with-retry (SO_REUSEADDR)
                          + deployed_sha chip per container +
@@ -107,6 +113,9 @@ hive-ag3nt/        in-container harness crate; produces TWO binaries
   src/turn_stats.rs     per-turn analytics sink (one sqlite row per
                          turn at /state/hyperhive-turn-stats.sqlite);
                          schema + best-effort writer
+  src/stats.rs          read-side aggregations over turn-stats.sqlite
+                         backing the /stats page (bucketed Snapshot:
+                         turns / duration / tokens / model mix)
   src/events.rs         LiveEvent + broadcast Bus + sqlite-backed history
                          (/state/hyperhive-events.sqlite) + TurnState +
                          model selection (persisted at /state/hyperhive-model)
@@ -116,7 +125,8 @@ hive-ag3nt/        in-container harness crate; produces TWO binaries
   src/login_session.rs  drives `claude auth login` over stdio pipes
   src/bin/hive-ag3nt.rs sub-agent main (Serve + Mcp subcommands)
   src/bin/hive-m1nd.rs  manager main (Serve + Mcp subcommands)
-  assets/               index.html, agent.css, app.js (include_str!)
+  assets/               index.html, agent.css, app.js, stats.html,
+                         stats.js (include_str!)
   prompts/              static role/tools/settings for claude (include_str!):
                           agent.md  — sub-agent system prompt
                           manager.md — manager system prompt
@@ -126,7 +136,10 @@ hive-sh4re/        wire types (HostRequest/Response, AgentRequest/Response,
                    ManagerRequest/Response, Message, Approval, HelperEvent)
 
 nix/
-  modules/hive-c0re.nix         systemd service + firewall + git wiring
+  modules/hive-c0re.nix         systemd service + firewall + git wiring;
+                                 imports hive-forge.nix
+  modules/hive-forge.nix        optional in-container Forgejo
+                                 (`hyperhive.forge.enable`, default on)
   templates/harness-base.nix    shared scaffolding for sub-agents + manager
   templates/agent-base.nix      sub-agent nixosConfiguration
   templates/manager.nix         manager nixosConfiguration
@@ -185,6 +198,33 @@ read them à la carte.
 In-flight or recent context that hasn't earned a section yet.
 Prune freely.
 
+- **Just landed:** dashboard side panel + forge-linked
+  config/approvals + per-bucket model stats. (a) Long content
+  (file previews, approval diffs, journald logs) opens in a
+  right-side slide-in panel instead of expanding inline;
+  markdown `.md` previews render through the vendored `marked`
+  bundle (`/static/marked.js` route added to the dashboard).
+  (b) the container-row `agent.nix` viewer + `/api/agent-config`
+  are gone — each row links to the agent's `agent-configs/<n>`
+  repo on the forge instead. (c) pending approvals render as a
+  card (identity / what-changed / decision actions) with a
+  `commit on forge` deep-link and a 3-way diff base toggle — vs
+  applied / vs last-approved / vs previous proposal — served by
+  the new `/api/approval-diff/{id}?base=` endpoint. (d) the
+  `/stats` page gained a per-bucket turns-by-model stacked bar
+  (`Snapshot.models` + `Bucket.model_counts`) since model
+  choice drives token cost. `/api/state` carries `forge_present`
+  so the links only show when the forge is up. Docs refreshed:
+  web-ui.md, approvals.md, turn-loop.md, agent.md, manager.md.
+- **Just landed:** `hyperhive.forge.enable` (default **true**) —
+  the forge option moved out of `services.hive-forge.*` into the
+  `hyperhive.*` namespace, and `hive-c0re.nix` imports
+  `hive-forge.nix` so the forge ships with the standard core
+  install. Forgejo settings gained
+  `migrations.ALLOW_LOCALNETWORKS = true` so an in-hive mirror
+  of the hyperhive repo can import from a `localhost` source
+  (Forgejo blocks loopback/RFC-1918 migration sources by
+  default).
 - **Just landed:** failed `nixos-container update` self-documents.
   `lifecycle::run` now appends the tail (40 lines) of the target
   container's own journal to the bail message when an `update`
@@ -565,11 +605,9 @@ Prune freely.
   agent_web_port + collision banner + spawn/rebuild preflight,
   browser notifications, focus-preserving refresh, generalised
   <details data-restore-key> survival, prompt-on-submit pattern.
-- **Open threads:** custom per-agent MCP tools (groundwork for
-  moving bitburner-agent into hyperhive), two-step spawn,
-  per-agent send allow-list, telemetry/charts, notes
-  compaction, unprivileged containers, Bash allow-list,
-  xterm.js. **Known bug** (in TODO.md): question id=5 was
-  queued but didn't render — likely a `pending()` row-decode
-  error swallowed by `unwrap_or_default`; investigate by curl
-  /api/state | jq '.questions' + browser console.
+- **Open threads:** two-step spawn, notes compaction,
+  unprivileged containers, Bash allow-list, xterm.js. The
+  deployment / gateway / privsep cluster is tracked in
+  `TODO-ops.md`. (Landed since this note was first written:
+  extra per-agent MCP servers, per-agent send allow-list,
+  telemetry + the `/stats` page.)