Move domain config from .env to a private SQLite store

Forges (multi-host) + tokens, project directories, and git identity now live in a private SQLite config store (internal/store, modernc.org/sqlite) on a /data named volume that is not bind-mounted or exposed, so credentials aren't reachable outside the container. New Settings page (/settings) + <settings-panel> with /api/config CRUD. Scanner reads roots fresh from the store each cycle; service resolves forges per-repo from the store and reapplies per-forge git auth on change. First run seeds the store from .env. Overturns the old no-datastore/.env-config laws (AGENT.md updated). Verified live end-to-end.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

web/templates/help.html

@@ -53,6 +53,21 @@
       <li><strong>Ahead / behind</strong> — commits your branch leads or trails its upstream by.</li>
     </ul>
 
+    <h2>Settings</h2>
+    <p>
+      Open <a href="/settings">Settings</a> to manage your configuration (it's
+      stored in a private database inside the app, not in files):
+    </p>
+    <ul>
+      <li><strong>Forges</strong> — add your Git hosting servers (Gitea) and their
+        access tokens. Tokens are saved securely and never shown again; to change
+        one, remove the forge and add it back.</li>
+      <li><strong>Project directories</strong> — the folders scanned for
+        repositories. Paths are inside the app's container (under a mounted folder
+        such as <code>/repos</code>); enable, disable, or remove them.</li>
+      <li><strong>Git identity</strong> — the name and email used for commits.</li>
+    </ul>
+
     <h2>Right-click commands</h2>
     <p>
       Right-click any repository for a menu of plain-language commands — no git