Config: .env = projects root only; derive each project's forge from git

Reduce .env to just REPOS_HOST_PATH (the projects root); runtime bootstrap moves to compose/defaults. Projects are the subdirectories of the single root — removed the project-directories feature (store table, service methods, /api/config/project-dirs, Settings section). Each project's forge is derived from its git remote (matched to a configured forge, else the bare host) and shown as a pill next to its name (State.Forge via scanner ForgeFor + svc.ForgeDisplay). Removed first-run .env seeding; forges + identity are managed in Settings. Added forge.HostOf. AGENT.md updated.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

components/settings-panel/settings-panel.md

@@ -1,30 +1,28 @@
 # settings-panel
 
 ## Intent
-The UI for the config store (AGENT.md §1.3) — manage forge hosts + tokens,
-project directories to scan, and the git commit identity, replacing hand-editing
-`.env` for domain config. Served at `/settings`.
+The UI for the config store (AGENT.md §1.5) — manage forge hosts + tokens and the
+git commit identity, replacing hand-editing `.env` for domain config. Projects
+themselves are the subdirectories of the single root set in `.env`, and each
+project's forge is derived from its git remote (not configured here). Served at
+`/settings`.
 
 ## Public surface
 - **Tag:** `<settings-panel>`
-- **Fetches:** `GET /api/config/forges`, `GET /api/config/project-dirs`,
-  `GET /api/config/identity`.
+- **Fetches:** `GET /api/config/forges`, `GET /api/config/identity`.
 - **Writes:**
   - Forges: `POST /api/config/forges` (add), `DELETE /api/config/forges/:id`.
-  - Project dirs: `POST /api/config/project-dirs` (add),
-    `PUT /api/config/project-dirs/:id` (enable/disable),
-    `DELETE /api/config/project-dirs/:id`.
   - Identity: `PUT /api/config/identity`.
 - **Reports:** results via `toast` CustomEvents (needs `<toast-host>` on the page).
 
 ## History
 - 2026-09-22: created — settings UI for the SQLite config store (forges, project
   dirs, git identity).
+- 2026-09-22: removed the Project directories section — projects are now the
+  subdirectories of the single `.env` root; only Forges + Git identity remain.
 
 ## Notes / gotchas
 - Tokens are **write-only** from the client: the server returns only `hasToken`,
   never the value. Removing + re-adding a forge is how you rotate a token.
-- Project-dir paths are **container paths** and must resolve inside the container
-  (under a mounted base); the server validates existence before adding.
 - Adding/removing a forge reapplies git auth (the server sets an `http.extraheader`
   per forge); changes take effect immediately.