hive reads the forge for nix as its own account, not core

hive-c0re copies the hive's store read token to /run/hyperhive/forge-hive-token
for nix's git credential helper, and no longer mints, reads or falls back to
the core admin token. drops the core user sweep, avatar upload, webhook
cleanup and hive-priv's RunForgeAdmin.

hive-priv/src/main.rs

@@ -21,7 +21,7 @@
 //! own module: [`container`] (lifecycle), [`container_config`] (nspawn flags,
 //! systemd drop-ins), [`storage`] (btrfs subvolumes, quotas, snapshots, disk
 //! measurement), [`files`] (pause marker, socket dir, legacy tmpfiles) and
-//! [`infra`] (gateway nginx, forge admin, infra containers). Helpers more than
+//! [`infra`] (gateway nginx, infra containers). Helpers more than
 //! one family uses are in [`shared`].
 
 mod container;
@@ -399,8 +399,6 @@ async fn exec(
 
         PrivRequest::ReloadGatewayNginx => infra::sync_gateway_nginx().await,
 
-        PrivRequest::RunForgeAdmin { ref args } => infra::exec_forge_admin(args).await,
-
         PrivRequest::SetAgentPaused {
             ref agent_name,
             paused,