Move domain config from .env to a private SQLite store

Forges (multi-host) + tokens, project directories, and git identity now live in a private SQLite config store (internal/store, modernc.org/sqlite) on a /data named volume that is not bind-mounted or exposed, so credentials aren't reachable outside the container. New Settings page (/settings) + <settings-panel> with /api/config CRUD. Scanner reads roots fresh from the store each cycle; service resolves forges per-repo from the store and reapplies per-forge git auth on change. First run seeds the store from .env. Overturns the old no-datastore/.env-config laws (AGENT.md updated). Verified live end-to-end.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.env.example

@@ -1,8 +1,19 @@
 # ---------------------------------------------------------------------------
 # GitManager configuration. Copy this file to `.env` and fill in values.
 # NEVER commit a real `.env` (it is git-ignored). See AGENT.md §1.5.
+#
+# NOTE: forges (URL + token), project directories, and the git identity now live
+# in the config DATABASE (a private SQLite store, AGENT.md §1.3), managed in the
+# app's Settings. The GITEA_*, GIT_REPO_ROOTS, and GIT_USER_* values below are
+# used ONLY to seed that DB the first time the app starts with an empty store;
+# after that, edit them in Settings (changing .env has no effect).
 # ---------------------------------------------------------------------------
 
+# Config store location (SQLite). docker-compose points this at a PRIVATE named
+# volume that is not bind-mounted or exposed, so credentials in it are only
+# reachable inside the container (AGENT.md §1.3).
+GITMANAGER_DB=/data/gitmanager.db
+
 # Address the HTTP server binds to. Localhost-only by default: there is NO
 # authentication (AGENT.md §0). Only bind to a non-local interface deliberately.
 LISTEN_ADDR=127.0.0.1:8080
@@ -21,9 +32,9 @@ HTTPS_ADDR=
 TLS_CERT_FILE=
 TLS_KEY_FILE=
 
-# Roots to scan for Git repositories, comma-separated (absolute paths).
-# Inside Docker these must be the *container* paths that the host roots are
-# mounted to (see docker-compose.yml). Example: /repos,/work/other
+# SEED ONLY (first run) → project directories in the config DB. Comma-separated
+# *container* paths (the host roots are mounted here; see docker-compose.yml).
+# After first run, manage these in Settings. Example: /repos,/work/other
 GIT_REPO_ROOTS=/repos
 
 # DOCKER ONLY: the HOST folder that holds your repositories. docker-compose
@@ -55,26 +66,22 @@ SCAN_FETCH_ENABLED=false
 # "dev" uses a readable console handler; anything else uses structured JSON.
 APP_ENV=dev
 
-# Commit identity for git actions the app runs (commit/etc.). Without these,
-# commits inside the container fail with "empty ident". Set to your name/email.
+# SEED ONLY (first run) → git identity in the config DB. Without an identity,
+# commits inside the container fail with "empty ident". After first run, set it
+# in Settings.
 GIT_USER_NAME=
 GIT_USER_EMAIL=
-# Note: when GITEA_URL + GITEA_TOKEN are set, the app also configures git to
-# authenticate to that host over HTTPS (an http.extraheader), so push/fetch/pull
-# work from the container without a separate SSH key or credential helper.
+# The app configures git to authenticate to each configured forge over HTTPS
+# (an http.extraheader per host), so push/fetch/pull work from the container
+# without a separate SSH key or credential helper.
 
 # Optional: also append structured logs to this file. Leave empty to disable.
 LOG_FILE=
 
-# --- Forge integration — token-gated, READ + WRITE (AGENT.md §8.4) ----------
-# The primary host is a self-hosted Gitea/Forgejo. Set BOTH the base URL and a
-# token to enable PRs + "Merge & clean up"; with neither, the forge features are
-# simply absent and the rest of the app is unaffected. A repo is forge-enabled
-# when its origin remote host matches GITEA_URL's host. Writes (merge PR + delete
-# branch) are confirmed per AGENT.md §1.4. Token scope: repo read + PR write +
-# branch delete.
+# --- Forge integration — SEED ONLY (first run) → forges in the config DB ----
+# Multiple forges are now supported and managed in Settings; this pair only
+# seeds the FIRST one on an empty DB. Set BOTH to enable PRs + "Merge & clean up"
+# for repos whose remote host matches this URL. Token scope: repo read + PR write
+# + branch delete. Writes are confirmed per AGENT.md §1.4.
 GITEA_URL=
 GITEA_TOKEN=
-# Later providers, behind the same interface (unused for now):
-GITHUB_TOKEN=
-GITLAB_TOKEN=