Config: .env = projects root only; derive each project's forge from git

Reduce .env to just REPOS_HOST_PATH (the projects root); runtime bootstrap moves to compose/defaults. Projects are the subdirectories of the single root — removed the project-directories feature (store table, service methods, /api/config/project-dirs, Settings section). Each project's forge is derived from its git remote (matched to a configured forge, else the bare host) and shown as a pill next to its name (State.Forge via scanner ForgeFor + svc.ForgeDisplay). Removed first-run .env seeding; forges + identity are managed in Settings. Added forge.HostOf. AGENT.md updated.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker-compose.yml

@@ -18,11 +18,11 @@ services:
       - HTTPS_ADDR=0.0.0.0:8443
       - TLS_CERT_FILE=/app/certs/localhost.pem
       - TLS_KEY_FILE=/app/certs/localhost-key.pem
-      # SEED ONLY (first run): the scanner's roots now live in the config DB.
-      # This is copied into the DB the first time the app starts with an empty DB.
-      - GIT_REPO_ROOTS=/repos
-      # Config store (forges, project dirs, git identity) on the PRIVATE volume
-      # below — not bind-mounted into the project, no network port (§1.3).
+      # The single projects root inside the container (each subdirectory is a
+      # project). The host folder is REPOS_HOST_PATH in .env, mounted here.
+      - PROJECTS_ROOT=/repos
+      # Config store (forges + tokens, git identity) on the PRIVATE volume below —
+      # not bind-mounted into the project, no network port (§1.3).
       - GITMANAGER_DB=/data/gitmanager.db
     ports:
       - "127.0.0.1:8080:8080"