Move domain config from .env to a private SQLite store

Forges (multi-host) + tokens, project directories, and git identity now live in a private SQLite config store (internal/store, modernc.org/sqlite) on a /data named volume that is not bind-mounted or exposed, so credentials aren't reachable outside the container. New Settings page (/settings) + <settings-panel> with /api/config CRUD. Scanner reads roots fresh from the store each cycle; service resolves forges per-repo from the store and reapplies per-forge git auth on change. First run seeds the store from .env. Overturns the old no-datastore/.env-config laws (AGENT.md updated). Verified live end-to-end.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

internal/config/config.go

@@ -23,7 +23,11 @@ type Config struct {
 	TLSCertFile string // PEM cert (e.g. an mkcert leaf trusted by the OS store)
 	TLSKeyFile  string // PEM private key
 
-	RepoRoots []string // roots to scan for git repositories
+	// DBPath is the SQLite config store (forges, project dirs, git identity).
+	// It lives on a private volume, not accessible outside the container (§1.3).
+	DBPath string
+
+	RepoRoots []string // SEED ONLY: roots to scan, used to seed the store on first run
 	GitBin    string   // path to the git binary
 
 	ScanInterval     time.Duration // scanner refresh interval
@@ -50,6 +54,7 @@ func Load() (Config, error) {
 
 	c := Config{
 		ListenAddr:       env("LISTEN_ADDR", "127.0.0.1:8080"),
+		DBPath:           env("GITMANAGER_DB", "/data/gitmanager.db"),
 		HTTPSAddr:        env("HTTPS_ADDR", ""),
 		TLSCertFile:      env("TLS_CERT_FILE", ""),
 		TLSKeyFile:       env("TLS_KEY_FILE", ""),