feat(forge): fondation multi-forges — connexions chiffrées, registre, client GitHub (P0/P1)

- Tables forge_connections/users/workspaces (+ membres, projets,
  états, audit) ; migration des anciennes bases avec portées
  (workspace_id, connection_id) par défaut (1, 1).
- Jetons chiffrés Fernet (KANBANTE_MASTER_KEY ou clé générée en
  base), jamais réaffichés.
- ForgeRegistry : connexion héritée créée depuis l'environnement,
  espace Principal, instantanés préfixés par connexion.
- GitHubClient complet (Bearer, pagination Link, étiquettes par
  nom, PATCH archived, branches via git/refs).
- Paramètres surchargeables en base (résolveur config, P3).

tests/conftest.py

@@ -66,8 +66,13 @@ def _issue(number: int, title: str, state: str = "open", pr: bool = False) -> di
 class FakeGitea:
     """Drop-in async replacement for GiteaClient used by the API tests."""
 
+    kind = "gitea"
+
     def __init__(self) -> None:
         now = datetime.now(timezone.utc)
+        self.connection_id = 1
+        self.connection_slug = "gitea"
+        self.key_prefix = ""
         self.starred = set()
         self.repos = [
             _repo("demo", now - timedelta(days=1)),
@@ -136,9 +141,17 @@ class FakeGitea:
                 results.append({**issue, "repository": {"full_name": full_name}})
         return results
 
+    async def set_archived(self, owner, repo, archived):
+        for r in self.repos:
+            if r["full_name"] == f"{owner}/{repo}":
+                r["archived"] = archived
+        return {"archived": archived}
+
     async def delete_label(self, owner, repo, label_id):
         labels = self.repo_labels.setdefault(f"{owner}/{repo}", {})
-        for name in [n for n, l in labels.items() if l["id"] == label_id]:
+        for name in [
+            n for n, l in labels.items() if str(l["id"]) == str(label_id)
+        ]:
             del labels[name]
         self.label_ops.append(("delete", f"{owner}/{repo}", label_id))