Split listing support: Gitea and Radicle as separate apps

- setup: with RUNNER_DIR, fetch the runner registration token from Gitea's
  admin API (POST /admin/actions/runners/registration-token) instead of the
  gitea CLI on Gitea's volume; record secrets/setup-status (ok, unreachable,
  bad-credentials) and exit cleanly when Gitea cannot be used.
- mirror: Radicle is optional. Repositories wait until a node is there (key and
  control socket in RAD_HOME), re-checked every reconcile; RADICLE=off.
- page: /status.json; hide the Radicle parts without a node, banner when Gitea
  is unreachable or refuses the login.
- example workflow: runs-on: ipcr, the forge's own runner label.
- docs: two listings, split (IPCR-Forge) and all in one (IPCR-Forge-AIO).

forge/example/.gitea/workflows/build.yml

@@ -7,13 +7,15 @@
 #                              the forge sets on every repository allowed to publish
 #   images: localhost:5000/…   this repository's own name there (no other is accepted)
 #   network=host               so buildx's builder can reach that registry
+#   runs-on: ipcr              the forge's own runner, the one that sees that registry (a Gitea app's
+#                              own runner, if there is one, does not)
 name: image
 on:
   push:
     tags: ['v*']
 jobs:
   image:
-    runs-on: ubuntu-latest
+    runs-on: ipcr
     steps:
       - uses: actions/checkout@v4
       - uses: docker/login-action@v3