IPCR Forge admin: name, health, unpublish, allowlist, key backup

ipcr 1.3.0 (gateway/):
- admin API on ADMIN_LISTEN (Bearer token in STATE_DIR/admin-token):
  status (key, node, storage, IPNS record here and on the network via
  delegated routing, ENS/DNSLink name check), providers/announce, peers,
  images, unpublish (tombstone + unpin unused objects), retag, reimport,
  config (name, allowlist), republish, key import (restore with
  sequence = max(network, local) + 1; previous key kept, kept copies reused)
- watcher refactored into shared state; config.json with an allowlist
  (IMPORT_ALLOW_REQUIRED); staging cleanup after publish (IMPORT_CLEANUP)
- IPNS records published with IPNS_LIFETIME / IPNS_TTL; superseded trees
  unpinned
- encrypted publisher-key backups (PBKDF2 + AES-256-GCM), ipcrd key decrypt

bridge 0.2.0 (bridge/):
- /admin: Gitea OAuth2 login (PKCE, site admins only), signed session,
  same-origin + X-IPCR-Admin on writes; setup registers the OAuth2 app
- admin page: publisher name and ENS/DNS check, health, published images,
  per-repository publish toggles (pushed to IPCR as its allowlist), key
  export (from Kubo's keystore, encrypted) and restore
- public page pull lines use the verified name

Compose: ipcr-admin internal network, keystore mount, 7-day IPNS lifetime,
staging GC at registry start. Verified on holyhorse (docs/forge.md).

Apps/IPCR-Forge/seed/ipcr/init.d/01-ipcr-node.sh

@@ -17,3 +17,8 @@ ipfs config --json Addresses.Swarm "[
 # Soft cap on the block store. Pinned images are never collected; with --enable-gc everything
 # else (blocks fetched but not pinned) is swept every Datastore.GCPeriod.
 ipfs config Datastore.StorageMax "${IPFS_STORAGE_MAX:-20GB}"
+
+# How long an IPNS record stays valid when Kubo republishes it (every 4 h, while online). Kubo's
+# default is 48 h: a node offline for a weekend would lose every name it publishes. ipcrd publishes
+# with the same lifetime (IPNS_LIFETIME).
+ipfs config Ipns.RecordLifetime "${IPCR_IPNS_LIFETIME:-168h}"