feat(forgejo): Mac mini Actions runner toolkit + server-side status monitor

[ulises-c]

Summary

Documents and tools the Mac mini Forgejo Actions runner, and adds a server-side
way to see whether it's up. Along the way this branch merges main (adopting
its HTTPS-via-tailscale serve Forgejo sidecar), hardens the runner scripts,
and adds a Privacy & Security policy plus an identifier scrub since the repo is
public.

The runner originally broke after the Forgejo server moved to its own Tailscale
node and the runner kept dialing the old endpoint. This branch makes the whole
path consistent: Forgejo is reached at https://forgejo.<tailnet>.ts.net
everywhere (runner config, server compose, docs).

Changes

Mac mini runner toolkit — macOS/forgejo-runner/ (new)

• install.sh / verify.sh / run.sh / lib.sh — build from source (Forgejo
  ships no macOS binaries), register, health-check, and control the LaunchAgent.
• net.forgejo.runner.plist.template, token-free forgejo-runner-config.example.yml,
  and a README covering setup and the connection refused failure mode.
• Instance URL comes from a gitignored .env (.env.example provided); the
  registration token is read with read -rs (no echo); dead code removed.

Server-side runner status monitor — linux-server/forgejo/ (new)

• runner-status.sh asks Forgejo's runners API whether the Mac mini runner is
  connected (idle/active = up, offline/absent/unreachable = down) and
  surfaces it three ways:
  • homepage forgejo-runner card (customapi JSON served by a loopback nginx
    added to docker-compose.yml on 127.0.0.1:8098),
  • Uptime Kuma push (KUMA_PUSH_URL),
  • ntfy alert on down/recovery transitions only.
• forgejo-runner-status.{service,timer} drive it every 2 minutes.
• Config in forgejo/.env (token + RUNNER_NAME + optional Kuma/ntfy); runtime
  JSON is gitignored.

Merge of main + HTTPS alignment

• Adopted main's HTTPS tailscale serve Forgejo sidecar (forgejo-ts,
  ROOT_URL=https://${FORGEJO_DOMAIN}/), superseding this branch's earlier
  HTTP-on-:3000 sidecar.
• Repointed the runner tooling and all Forgejo docs from http://…:3000 to
  https://forgejo.<tailnet>.ts.net (Git SSH stays on :22).

Privacy & Security

• New Privacy & Security section in CLAUDE.md: repo is public — keep
  identifying/secret values out of tracked files, use gitignored .env +
  committed .env.example placeholders.
• Scrubbed the real hostname, LAN IP, and tailnet name to
  <hostname> / <server-ip> / <tailnet> across the server configs and docs.

Homepage

• Moved the NAS group to the bottom of the dashboard (pure block move).

Validation

• shellcheck --severity=warning clean on all shell; runner-status.sh parsing
  tested against bare-array / {runners|entries}-wrapper / absent / unreachable
  responses; YAML files parse.
• Not validated against the live server (no Docker here). Before applying:
  • run docker compose config in linux-server/forgejo/;
  • update the live Mac mini runner's config url: to
    https://forgejo.<tailnet>.ts.net, then bash macOS/forgejo-runner/run.sh restart;
  • confirm the monitor's API endpoint — it defaults to the instance/admin scope
    (/api/v1/admin/actions/runners) and is overridable via
    FORGEJO_RUNNER_API_URL if your token is org/repo-scoped.

🤖 Generated with Claude Code