Move domain config from .env to a private SQLite store

Forges (multi-host) + tokens, project directories, and git identity now live in a private SQLite config store (internal/store, modernc.org/sqlite) on a /data named volume that is not bind-mounted or exposed, so credentials aren't reachable outside the container. New Settings page (/settings) + <settings-panel> with /api/config CRUD. Scanner reads roots fresh from the store each cycle; service resolves forges per-repo from the store and reapplies per-forge git auth on change. First run seeds the store from .env. Overturns the old no-datastore/.env-config laws (AGENT.md updated). Verified live end-to-end.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

web/templates/index.html

@@ -42,7 +42,7 @@
   <header>
     <h1>GitManager</h1>
     <span style="color: var(--color-fg-muted)">multi-repo dashboard</span>
-    <nav><a href="/help">Help</a></nav>
+    <nav><a href="/settings">Settings</a> · <a href="/help">Help</a></nav>
   </header>
   <main>
     <handoff-bar></handoff-bar>