Split listing support: Gitea and Radicle as separate apps

- setup: with RUNNER_DIR, fetch the runner registration token from Gitea's
  admin API (POST /admin/actions/runners/registration-token) instead of the
  gitea CLI on Gitea's volume; record secrets/setup-status (ok, unreachable,
  bad-credentials) and exit cleanly when Gitea cannot be used.
- mirror: Radicle is optional. Repositories wait until a node is there (key and
  control socket in RAD_HOME), re-checked every reconcile; RADICLE=off.
- page: /status.json; hide the Radicle parts without a node, banner when Gitea
  is unreachable or refuses the login.
- example workflow: runs-on: ipcr, the forge's own runner label.
- docs: two listings, split (IPCR-Forge) and all in one (IPCR-Forge-AIO).

README.md

@@ -15,9 +15,12 @@ registry gateway, IPFS import, IPNS naming and admin API), used here as the imag
 `ghcr.io/yundera/ipcr`.
 
 - **[docs/forge.md](docs/forge.md)**: how it works, the trust model, findings, what was verified.
-- **[Apps/IPCR-Forge](https://github.com/Yundera/ipcr/tree/main/Apps/IPCR-Forge)** (in the IPCR repository, with the
-  rest of the IPCR app store): the Yundera AppStore listing (compose, rationale, seed). It pins this
-  repository's image and the engine's.
+- **[Apps/IPCR-Forge](https://github.com/Yundera/ipcr/tree/main/Apps/IPCR-Forge)** and
+  **[Apps/IPCR-Forge-AIO](https://github.com/Yundera/ipcr/tree/main/Apps/IPCR-Forge-AIO)** (in the IPCR repository,
+  with the rest of the IPCR app store): the Yundera AppStore listings (compose, rationale, seed). The
+  first uses the store's Gitea app (and its Radicle app, if installed); the second bundles both.
+  Both pin this repository's image and the engine's. See
+  [docs/forge.md](docs/forge.md#two-listings-split-and-all-in-one).
 - **[forge/](forge/)**: the forge service, `ghcr.io/yundera/ipcr-forge` (Go, standard library only):
   the Gitea → Radicle mirror, the forge's page and admin pages (Gitea login), the staging registry's
   gate and per-repository push credentials, and the install step.
@@ -33,5 +36,5 @@ docker build -t ghcr.io/yundera/ipcr-forge:dev forge
 
 Releases: a `vX.Y.Z` tag publishes `ghcr.io/yundera/ipcr-forge:X.Y.Z`
 ([.github/workflows/image.yml](.github/workflows/image.yml)). Then bump the version in the
-listing, `Apps/IPCR-Forge/docker-compose.yml` in the IPCR repository (the service, `forge-gate`
-and the `forge-setup` step).
+listings, `Apps/IPCR-Forge/docker-compose.yml` and `Apps/IPCR-Forge-AIO/docker-compose.yml` in
+the IPCR repository (the service, `forge-gate` and the `forge-setup` step, in each).