Split listing support: Gitea and Radicle as separate apps

- setup: with RUNNER_DIR, fetch the runner registration token from Gitea's
  admin API (POST /admin/actions/runners/registration-token) instead of the
  gitea CLI on Gitea's volume; record secrets/setup-status (ok, unreachable,
  bad-credentials) and exit cleanly when Gitea cannot be used.
- mirror: Radicle is optional. Repositories wait until a node is there (key and
  control socket in RAD_HOME), re-checked every reconcile; RADICLE=off.
- page: /status.json; hide the Radicle parts without a node, banner when Gitea
  is unreachable or refuses the login.
- example workflow: runs-on: ipcr, the forge's own runner label.
- docs: two listings, split (IPCR-Forge) and all in one (IPCR-Forge-AIO).

forge/state.go

@@ -15,7 +15,7 @@ import (
 const (
 	stSynced  = "synced"  // Radicle has what Gitea has
 	stError   = "error"   // the last sync failed; retried on the next event or reconcile
-	stWaiting = "waiting" // empty repository: nothing to publish yet
+	stWaiting = "waiting" // empty repository, or no Radicle node yet: nothing to publish to
 	stFrozen  = "frozen"  // no longer public in Gitea (or deleted): no further sync, nothing retracted
 )