panel: Forgejo integration, ssh deploy key and per-app environment variables

Forgejo:
- panel.nix passes the local Forgejo's public, API and ssh URLs (derived
  from forgejo.nix) to panel-api.
- Settings dialog: connect a Forgejo access token (verified against
  /api/v1/user, stored 0600 in state/panel/forgejo-token).
- New-app dialog gets a Forgejo repository picker with search and a branch
  dropdown; private repos are cloned over https with the stored token, or
  over ssh with the deploy key when no token is connected. The app name and
  domain are filled in from the repository name.
- Commit and compare links in the Source tab point at Forgejo; cards show
  the provider ("Forgejo · main").

Git over ssh:
- ssh:// and git@host:owner/repo URLs are accepted; the panel generates an
  ed25519 deploy key in state/panel/ssh and uses it for clone/fetch
  (BatchMode, accept-new host keys). openssh added to the service path.
- Credential redaction only applies to http(s) URLs, so ssh usernames are
  kept; git errors now report the meaningful line instead of git's advice.

Environment variables:
- Stored per app in state/env/<app>.env (0600), outside the repo and stack.
- panelctl passes them to every compose command via env(1), so ${VAR}
  interpolation works; by default deploy/restart also generate a compose
  override listing the keys under every service's environment (values are
  read from compose's environment, never quoted into YAML).
- Environment tab (and a section in the new-app dialog) with .env paste
  import, hidden values, validation of names (reserved podman/compose vars
  rejected), hints for ${VAR}s the compose file uses but aren't set, and
  Save / Save & deploy. Removing an app deletes its variables.

The API still accepts the old source_type "github" / github_* fields.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UbWSNkXxZhYf7eqHTyx3Bf

panel.nix

@@ -1,5 +1,8 @@
-{ config, pkgs, ... }:
+{ config, lib, pkgs, ... }:
 
+let
+  forgejoServer = config.services.forgejo.settings.server;
+in
 {
   environment.systemPackages = [
     (pkgs.writeShellScriptBin "panelctl" (builtins.readFile ./panel/panelctl.sh))
@@ -34,6 +37,7 @@
       pkgs.unzip
       pkgs.git
       pkgs.util-linux # flock, used by panelctl to serialise routes file writes
+      pkgs.openssh # cloning repositories over ssh with the panel's deploy key
     ];
 
     serviceConfig = {
@@ -52,6 +56,12 @@
       PANEL_BASE_DIR = "/var/lib/containers";
       PANELCTL_PATH = "/run/current-system/sw/bin/panelctl";
       PANEL_FRONTEND_DIR = "${./panel/frontend}";
+
+      # Forgejo integration (repo picker, private clones, commit links).
+      # The API is reached on localhost; clones use the public URLs.
+      PANEL_FORGEJO_URL = lib.removeSuffix "/" forgejoServer.ROOT_URL;
+      PANEL_FORGEJO_API_URL = "http://${forgejoServer.HTTP_ADDR}:${toString forgejoServer.HTTP_PORT}";
+      PANEL_FORGEJO_SSH_URL = "ssh://${forgejoServer.BUILTIN_SSH_SERVER_USER}@${forgejoServer.DOMAIN}:${toString forgejoServer.SSH_PORT}";
     };
   };