extra-forges: fully dashboard-provisioned, no host config

Per mara's feedback on PR #2407 ("better: you can also provide url in
dashboard, same as with matrix, no host config"), drops
services.hyperhive.extraForges and the admin-API mint/revoke flow
entirely. The operator now creates a token on the external forge
themselves and pastes a label + base URL + access token into the
dashboard's FORGES tab, the same shape as the GitHub PAT flow plus the
base-URL field from the matrix extra-account flow. hive-c0re only ever
writes/deletes two local files per account (forge-<label>-token,
forge-<label>.json sidecar for the URL) via hive-priv — no remote
account creation, no admin token, no revoke-on-the-remote-side, no nix
config to enumerate.

- nix/host-modules/hive-forge/default.nix: removed the extraForges
  option, its label-format assertion, and the HYPERHIVE_EXTRA_FORGES
  env forwarding.
- hive-c0re/src/forge/extra.rs: deleted (REST admin-API provisioning,
  no longer needed).
- hive-c0re/src/dashboard/extra_forges.rs: GET /api/extra-forges?
  agent= lists an agent's stored forges by scanning its state dir
  (mirrors matrix_accounts.rs's filename-scan listing), POST
  /api/extra-forge-account (agent/label/base_url/token/
  action=add|remove) stores or removes an account.
- hive-sh4re/priv_proto.rs + hive-priv/main.rs: new
  WriteAgentExtraForgeAccount/DeleteAgentExtraForgeAccount priv
  requests (adds base_url, writes/deletes a JSON sidecar alongside the
  token).
- hive-c0re/src/priv_client.rs: matching wrapper functions.
- frontend/packages/dashboard/src/credentials.{html,js}: FORGES tab is
  a per-agent list + add-account paste form (label/base_url/token), no
  grant/revoke-from-catalog UI.
- docs/web-ui/dashboard.md: FORGES tab section rewritten.

Supersedes the design in PR #2407 (already approved+green on the old
admin-API model) — opening as a fresh PR against the same issues
rather than force-pushing over the approved one.

frontend/packages/dashboard/src/credentials.html

@@ -26,6 +26,10 @@
          aria-controls="cred-pane-github" data-tab="github">
         <span class="cred-tab-label">GITHUB</span>
       </a>
+      <a class="hive-tab" id="cred-tab-forges" href="#forges" role="tab"
+         aria-controls="cred-pane-forges" data-tab="forges">
+        <span class="cred-tab-label">FORGES</span>
+      </a>
     </nav>
   </header>
 
@@ -125,6 +129,38 @@
       </form>
     </section>
 
+    <!-- FORGES tab: external Forgejo/Gitea/Codeberg-compatible forges.
+         Entirely dashboard-provisioned, no host-side nix config &mdash; same
+         shape as GITHUB plus a base-URL field (like MATRIX's homeserver).
+         The operator creates a token on the external forge themselves
+         (however that forge lets them) and pastes label + URL + token
+         below. No remote account minting/revoking &mdash; purely local. -->
+    <section class="cred-pane" id="cred-pane-forges" data-tab-pane="forges"
+             role="tabpanel" aria-labelledby="cred-tab-forges" hidden>
+      <p class="meta">store a <strong>label + base URL + access token</strong> for an external Forgejo/Gitea/Codeberg-compatible forge, per agent. no account is created on the remote forge &mdash; create the token there yourself first. the token is never displayed back on this page.</p>
+
+      <h3>◇ provisioned forges</h3>
+      <div id="ef-list" class="ef-list"><p class="meta">select an agent to see its forge accounts.</p></div>
+
+      <h3>◇ add forge account</h3>
+      <form id="ef-form" class="ma-form" autocomplete="off">
+        <label class="ma-field">
+          <span>label</span>
+          <input type="text" name="label" placeholder="e.g. codeberg" required>
+        </label>
+        <label class="ma-field">
+          <span>base url</span>
+          <input type="text" name="base_url" placeholder="https://codeberg.org" required>
+        </label>
+        <label class="ma-field">
+          <span>access token</span>
+          <input type="password" name="token" autocomplete="off" required>
+        </label>
+        <button type="submit" class="btn btn-spawn">store account</button>
+        <p id="ef-result" class="ma-result" aria-live="polite"></p>
+      </form>
+    </section>
+
   </main>
 
   <script type="module" src="/static/credentials.js" defer></script>