split hivectl main.rs into per-domain modules (#2509)

hivectl/src/forge.rs

@@ -0,0 +1,31 @@
+//! `hivectl forge create-user <name>` — provision a Forgejo account via the
+//! daemon (which owns the forge admin token + account-token persistence);
+//! hivectl just resolves the password client-side and relays the request.
+
+use std::path::Path;
+
+use anyhow::Result;
+
+use crate::util::{daemon_request, resolve_password};
+
+pub(crate) async fn forge_create_user(
+    socket: &Path,
+    name: &str,
+    password: Option<&str>,
+    password_stdin: bool,
+) -> Result<()> {
+    // Resolve the password client-side (inline flag or stdin read); the
+    // daemon never touches this process's stdin. The is-present check, the
+    // agent-vs-operator branch, and token persistence now live in the
+    // daemon handler.
+    let password = resolve_password(password, password_stdin)?;
+    daemon_request(
+        socket,
+        hive_host_sock::HostRequest::ForgeCreateUser {
+            name: name.to_owned(),
+            password,
+        },
+        "forge",
+    )
+    .await
+}