IPCR Forge: org-root image names and per-repository push credentials

Short names: the public repositories of one Gitea organisation (IPCR_ROOT_ORG,
then the admin page; metadec on our boxes) are also published at the root of
the forge's name, so ipcr.localhost:4767/ipns/metadec.eth/ipcr-hello:1.0.0
works. Collisions (a user/org of that name, another owner's folder) are
skipped and explained.

Push credentials: the staging registry now sits behind forge-gate
(ipcr-forge-bridge gate), in the CI daemon's network namespace, with the
registry on a unix socket and no network. Each publishing repository logs in
as <owner>/<repo> with an IPCR_PUSH_TOKEN Actions secret the bridge sets, and
may push its own name only; IPCR logs in with a credential it generates.
Workflows need a docker/login-action step (example and page updated).

ipcr 1.4.0: allow.aliases with per-pass alias sync; unpublish/retag on every
path; IMPORT_AUTH_GENERATE; names this node publishes resolve via
name/resolve --nocache (Kubo's resolve cache lagged, and the generic resolve
ignores nocache).

bridge 0.3.0: gate, push credentials (rotate in the admin page), root
organisation setting, setup creates the org and the example in it; the
Radicle description carries the Gitea path (identical documents gave the same
RID); OAuth2 app updated only when hosts change, keeping the new secret.
Admin page: tabs, one-line keys, name-check feedback, per-tag docker pull
commands (IPFS, IPNS, ENS, short path first).

Verified on holyhorse (docs/forge.md).

forge/example/.gitea/workflows/build.yml

@@ -2,8 +2,10 @@
 # IPCR picks it up from there within a minute and publishes it on IPFS; the forge's page then
 # lists the exact `image:` line to use.
 #
-# Differences from a GitHub-hosted workflow, both needed on this forge:
-#   images: localhost:5000/…   the staging registry (no login, no secret)
+# Differences from a GitHub-hosted workflow, all needed on this forge:
+#   login to localhost:5000    the staging registry, as this repository: IPCR_PUSH_TOKEN is a secret
+#                              the forge sets on every repository allowed to publish
+#   images: localhost:5000/…   this repository's own name there (no other is accepted)
 #   network=host               so buildx's builder can reach that registry
 name: image
 on:
@@ -14,6 +16,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+      - uses: docker/login-action@v3
+        with:
+          registry: localhost:5000
+          username: ${{ github.repository }}
+          password: ${{ secrets.IPCR_PUSH_TOKEN }}
       - uses: docker/metadata-action@v5
         id: meta
         with: