feat(hephaestus.x): /forge lists real repos instead of auto-redirecting

Previous version was a 100ms bounce to code.silentmode.st — user never saw
hephaestus.x/forge/ content, just a flash. New version is a real catalog page:

- Fetches public repo list live from Forgejo's API on page load
- Renders each repo as a card with name, owner, description, updated date,
  clickable to code.silentmode.st/<owner>/<repo> when the user chooses
- Falls back to a "browse directly at code.silentmode.st" hint on API error
- Includes the git clone URL patterns (HTTPS-with-PAT and SSH-2222) inline

Enabled CORS on Forgejo so hephaestus.x (served from a different origin)
can hit /api/v1/repos/search — Access-Control-Allow-Origin: *, methods
GET+HEAD only, no credentials. That's the minimum for public listings and
matches how the API is meant to be used.

/forgejo/ is a byte-identical alias.

docker-compose.yml

@@ -83,6 +83,11 @@ services:
       FORGEJO__storage.repo-archive__MINIO_BASE_PATH: archives/
       # Live git repos still live on local disk under /data/git — S3 is only for LFS
       # and other cold blobs. Never point [repository] itself at S3.
+      # --- CORS (so hephaestus.x and other BCNR-served pages can list public repos) ---
+      FORGEJO__cors__ENABLED: "true"
+      FORGEJO__cors__ALLOW_DOMAIN: "*"
+      FORGEJO__cors__ALLOW_CREDENTIALS: "false"
+      FORGEJO__cors__METHODS: "GET,HEAD"
       # --- Quota (free tier: 500 MB per user) ---
       FORGEJO__quota__ENABLED: "true"
       FORGEJO__quota__DEFAULT_GROUPS: free