docs: refresh for the dashboard rework + recent harness commits

- web-ui.md: side panel, approval card + 3-way diff base, stats
  page, forge config links, removed agent.nix viewer, per-agent
  loose-ends inline answer.
- approvals.md: forge mirror section + diff base toggle.
- turn-loop.md: recv(max), get_logs, remind, loose-ends, whoami.
- agent.md / manager.md prompts: recv(max), remind, get_logs.
- CLAUDE.md: forge.rs / stats.rs / hive-forge.nix in the file
  map, scratchpad refresh.

also: forgejo migrations.ALLOW_LOCALNETWORKS = true so an in-hive
mirror of the hyperhive repo can import from a localhost source.

docs/turn-loop.md

@@ -102,11 +102,14 @@ it as a stdio child via `--mcp-config`. The hyperhive socket name is
 - `send(to, body)` — message a peer (logical agent name), another
   agent, or the operator (recipient `operator`, surfaces in the
   dashboard inbox).
-- `recv(wait_seconds?)` — drain one inbox message. Without
+- `recv(wait_seconds?, max?)` — drain inbox messages. Without
   `wait_seconds` (or with `0`) returns immediately, a cheap
   "anything pending?" peek. Positive value parks the turn up
   to that many seconds (cap 180) — incoming messages wake
-  instantly, otherwise returns empty at the timeout.
+  instantly, otherwise returns empty at the timeout. `max`
+  (default 1, server-side cap 32) drains up to N popped rows
+  in one round-trip; `wait_seconds` applies to the *first*
+  message, then the call drains up to `max` total.
 - `ask(question, options?, multi?, ttl_seconds?, to?)` —
   surface a structured question. Same shape as the manager's;
   recipient defaults to the operator (dashboard) but can be set
@@ -119,6 +122,21 @@ it as a stdio child via `--mcp-config`. The hyperhive socket name is
   routed to this agent. Authorisation is strict: only the
   declared target (or the operator via the dashboard) can
   answer.
+- `get_loose_ends()` — list everything still pending against
+  this agent: unanswered questions it asked / was asked, plus
+  reminders it scheduled. Each row carries an id + kind for
+  `cancel_loose_end`.
+- `cancel_loose_end(kind, id)` — withdraw a `question`
+  (posts `[cancelled by <self>]` to unblock the asker) or a
+  `reminder` (hard-delete before fire). Sub-agents may only
+  cancel rows they own.
+- `remind(message, due)` — schedule a reminder that lands in
+  this agent's own inbox at a future time (sender shows as
+  `reminder`). Large payloads spill to
+  `/agents/<self>/state/reminders/` with the inbox message a
+  short pointer.
+- `whoami()` — `{ name, role, pronouns, hyperhive_rev }` for
+  self-identification without scraping the system prompt.
 
 ### Waking the agent from inside the container
 
@@ -191,6 +209,16 @@ meta's.
   that was routed to the manager (a sub-agent did
   `ask(to: "manager", ...)`). Surfaces in the asker's inbox as
   the same `question_answered` event.
+- `get_logs(agent, lines?)` — fetch recent journal lines for a
+  sub-agent container (diagnose MCP-registration failures,
+  startup crashes, etc.). Pass the plain logical agent name;
+  hive-c0re resolves the machine name (`h-<name>`, manager
+  `hm1nd`). `lines` defaults to 50, host-capped at 500.
+- `remind` / `get_loose_ends` / `cancel_loose_end` / `whoami` —
+  same as the sub-agent tools above, but `get_loose_ends` is
+  hive-wide (every agent's pending questions + reminders, not
+  just the manager's) and `cancel_loose_end` may cancel any
+  agent's row.
 
 The boundary: lifecycle ops on *existing* sub-agents
 (`kill`/`start`/`restart`) are at the manager's discretion — no