IPCR Forge v3: Gitea as the source of truth, public repos mirrored to Radicle

Users found Radicle-as-source unfriendly (v1, v2). Gitea is now where
people work; its Actions build images into the staging registry IPCR
follows, as in v2.

- bridge/: ipcr-forge-bridge (Go). Install step mints a public-only
  token, registers one system webhook and creates the ipcr-hello example;
  the service mirrors every public repo one way to Radicle (rad init,
  canonical tags rule, git push rad) and serves the forge's page.
- Compose: gitea + act_runner on a separate dind; tile opens Gitea;
  tips link the forge page.
- Removed the Radicle CI broker (ci/) and the nginx landing page.

forge/example/Dockerfile

@@ -0,0 +1,6 @@
+# A one-page web server: busybox httpd on port 8080, as an unprivileged user.
+FROM busybox:1.37
+COPY index.html /www/index.html
+USER 1000:1000
+EXPOSE 8080
+CMD ["httpd", "-f", "-p", "8080", "-h", "/www"]