swarm-controller: re-read the forge token from the store when the forge rejects it

The controller read its forge token from the swarm secret store once, when
its client slot filled, and kept sending it until the daemon restarted. A
token the forge re-minted or revoked left every forge-backed path failing
with 401 until someone restarted the controller, and a restart drops the
runtime-only job graph.

Every forge request now goes through `forge::api::Api::call`. On a 401 it
asks a `StoredSecret` (the queue clients' debounced, single-flight re-read
with backoff) for a token to try instead, rebuilds the forgejo client with
it, and sends the request once more. A second 401, or a store still holding
the refused token, surfaces the error as before. Only 401 counts: unlike an
IdP, the forge answers 400 to a malformed request, and a re-read started by
one would put a real 401 that follows inside the backoff.

forgejo-api bakes the token into its own reqwest client's default headers
and takes no client or middleware from outside, so there is no single
request function to hook. Each `self.api.<endpoint>(..)` site becomes
`self.api.call(|api| api.<endpoint>(..).into_future())`; option structs a
site moved into the call are cloned, since the closure can run twice. The
`OnceLock<Arc<Client>>` slot and its `get()` callers are unchanged.

Refs #5017

swarm-controller/src/forge/site_admin.rs

@@ -75,7 +75,7 @@ impl Client {
     /// # Errors
     /// When the forge refuses the read or the edit.
     pub async fn make_site_admin(&self, name: &str) -> Result<Plan> {
-        let user = match self.api.user_get(name).await {
+        let user = match self.api.call(|api| api.user_get(name).into_future()).await {
             Ok(user) => Some(user),
             Err(e) if is_not_found(&e) => None,
             Err(e) => return Err(e).with_context(|| format!("read forge user {name}")),
@@ -83,7 +83,7 @@ impl Client {
         let plan = plan(user.as_ref());
         if plan == Plan::Promote {
             self.api
-                .admin_edit_user(name, admin_edit())
+                .call(|api| api.admin_edit_user(name, admin_edit()).into_future())
                 .await
                 .with_context(|| format!("make forge user {name} a site admin"))?;
             tracing::info!(%name, "swarm forge: made the user a site admin");