panel: Forgejo integration, ssh deploy key and per-app environment variables

Forgejo:
- panel.nix passes the local Forgejo's public, API and ssh URLs (derived
  from forgejo.nix) to panel-api.
- Settings dialog: connect a Forgejo access token (verified against
  /api/v1/user, stored 0600 in state/panel/forgejo-token).
- New-app dialog gets a Forgejo repository picker with search and a branch
  dropdown; private repos are cloned over https with the stored token, or
  over ssh with the deploy key when no token is connected. The app name and
  domain are filled in from the repository name.
- Commit and compare links in the Source tab point at Forgejo; cards show
  the provider ("Forgejo · main").

Git over ssh:
- ssh:// and git@host:owner/repo URLs are accepted; the panel generates an
  ed25519 deploy key in state/panel/ssh and uses it for clone/fetch
  (BatchMode, accept-new host keys). openssh added to the service path.
- Credential redaction only applies to http(s) URLs, so ssh usernames are
  kept; git errors now report the meaningful line instead of git's advice.

Environment variables:
- Stored per app in state/env/<app>.env (0600), outside the repo and stack.
- panelctl passes them to every compose command via env(1), so ${VAR}
  interpolation works; by default deploy/restart also generate a compose
  override listing the keys under every service's environment (values are
  read from compose's environment, never quoted into YAML).
- Environment tab (and a section in the new-app dialog) with .env paste
  import, hidden values, validation of names (reserved podman/compose vars
  rejected), hints for ${VAR}s the compose file uses but aren't set, and
  Save / Save & deploy. Removing an app deletes its variables.

The API still accepts the old source_type "github" / github_* fields.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UbWSNkXxZhYf7eqHTyx3Bf

API.md

@@ -13,6 +13,10 @@ Default bind: `127.0.0.1:9911`
 | GET | `/` | Web UI (served from `frontend/index.html`) |
 | GET | `/health` | Health check |
 | GET | `/status` | All apps with routes, container status and running operation (what the UI polls) |
+| GET | `/integrations` | Forgejo connection (`configured`, `url`, `has_token`, `user`) and the SSH deploy public key |
+| POST | `/integrations/forgejo` | `{"token": "..."}` — verify against Forgejo and store; `""` disconnects |
+| GET | `/forgejo/repos?q=` | Search repositories visible to the stored token (public ones without) |
+| GET | `/forgejo/branches?repo=owner/name` | Branch names of a Forgejo repository |
 
 ### Apps — Read
 
@@ -26,7 +30,8 @@ Default bind: `127.0.0.1:9911`
 | GET | `/apps/<name>/logs?tail=N` | Fetch last N log lines (default 100) |
 | GET | `/apps/<name>/backups` | List available backups |
 | GET | `/apps/<name>/backups/<file>` | Download backup zip |
-| GET | `/apps/<name>/repo` | Git source info (URL, branch, deployed commit, local changes) |
+| GET | `/apps/<name>/env` | Environment variables: `{"vars": [{"key", "value"}], "inject": true}` |
+| GET | `/apps/<name>/repo` | Git source info (URL, web URL, provider, branch, deployed commit, local changes, deploy key for ssh) |
 | GET | `/apps/<name>/repo?fetch=1` | Same, plus fetches the remote and reports `behind` / `remote` |
 | GET | `/apps/<name>/volumes` | Volumes the file browser can open |
 | GET | `/apps/<name>/volume/files?vol=&path=` | List a folder in a volume |
@@ -50,28 +55,37 @@ Default bind: `127.0.0.1:9911`
 | POST | `/apps/<name>/restore` | Restore from backup |
 | POST | `/apps/<name>/remove` | Remove app |
 | POST | `/apps/<name>/repo-pull` | Git apps: fetch branch, hard-reset checkout to it, redeploy |
+| POST | `/apps/<name>/env` | Replace environment variables: `{"vars": [...], "inject": true, "deploy": false}` |
 | POST | `/apps/<name>/volume-clear` | Stop the app and empty its default data folder |
 
 Write operations are serialised per app. While one runs, another write to the
 same app returns `409` with `{"ok": false, "error": "...", "busy": "deploy"}`.
 `deploy` returns the compose output in `stdout` (or `stderr` on failure).
 
-### Create app (git repository)
+### Create app (git repository, with environment variables)
 
 ```json
 {
   "name": "blog",
   "routes": [{"domain": "blog.srazka.com", "upstream": "127.0.0.1:18090"}],
   "auth": true,
-  "source_type": "github",
-  "github_url": "https://git.srazka.com/reudy-net/blog.git",
-  "github_branch": "",
-  "github_pat": ""
+  "source_type": "git",
+  "repo_url": "https://git.srazka.com/reudy-net/blog.git",
+  "repo_branch": "",
+  "use_forgejo_token": true,
+  "env": [{"key": "DATABASE_URL", "value": "postgres://..."}],
+  "env_inject": true
 }
 ```
 
-Any http(s) git host works. An empty branch uses the repository's default branch.
-The compose file must be at the repository root.
+- `repo_url` may be `https://…`, `ssh://git@host:port/owner/repo.git` or
+  `git@host:owner/repo.git`. ssh URLs use the panel's deploy key.
+- `repo_token` sets an https token explicitly; `use_forgejo_token` uses the
+  token stored in Settings (only for URLs on the configured Forgejo host).
+- An empty branch uses the repository's default branch. The compose file must
+  be at the repository root.
+- The older `source_type: "github"` with `github_url` / `github_branch` /
+  `github_pat` is still accepted.
 
 ### Sync response (`repo-pull`)