Migrate Forgejo from Homebrew to source build (#316)

## Summary

- Migrate Forgejo from Homebrew to source-built binary with mcquack LaunchAgent
- Matches the established pattern used by zot, caddy, and alloy
- Upgrades to v14.0.3 (7 security fixes: PKCE bypass, OAuth scope bypass, open redirect, and more)

## Changes

- **Ansible role**: Replace brew install/services with binary stat check + LaunchAgent
- **Paths**: `/opt/homebrew/var/forgejo` → `~/forgejo`, binary at `~/code/3rd/forgejo/forgejo`
- **Run user**: `forgejo` → `erichblume` (LaunchAgent user; SSH git user stays `forgejo`)
- **Docs**: Updated Forgejo reference card, restart-indri guide
- **Service review**: Stamped frigate-notify, cloudnative-pg, blumeops-pg as current

## One-time migration steps (manual, on indri)

1. Clone from Codeberg, add forge mirror remote
2. Check out v14.0.3, build with `make build && make forgejo`
3. Stop brew, `cp -a` data to `~/forgejo`, fix ownership
4. Run `provision-indri --tags forgejo`
5. Verify, then `brew uninstall forgejo`

## Data safety

- `cp -a` preserves everything (repos, SQLite DB, LFS, sessions, OAuth config)
- Brew version stays installed as rollback until verification passes
- No schema changes between 14.0.2 → 14.0.3

Reviewed-on: #316

service-versions.yaml

@@ -59,7 +59,7 @@ services:
 
   - name: frigate-notify
     type: argocd
-    last-reviewed: 2026-02-22
+    last-reviewed: 2026-03-28
     current-version: "v0.5.4"
     upstream-source: https://github.com/0x2142/frigate-notify/releases
 
@@ -112,7 +112,7 @@ services:
 
   - name: cloudnative-pg
     type: argocd
-    last-reviewed: 2026-02-24
+    last-reviewed: 2026-03-28
     current-version: "v1.28.1"
     upstream-source: https://github.com/cloudnative-pg/cloudnative-pg/releases
     notes: Deployed via Helm chart (chart v0.27.1 from forge mirror)
@@ -147,7 +147,7 @@ services:
 
   - name: blumeops-pg
     type: argocd
-    last-reviewed: 2026-02-27
+    last-reviewed: 2026-03-28
     current-version: "18.3"
     upstream-source: https://github.com/cloudnative-pg/cloudnative-pg/releases
     notes: CloudNativePG Cluster resource; pinned to PG minor version
@@ -287,10 +287,10 @@ services:
 
   - name: forgejo
     type: ansible
-    last-reviewed: 2026-02-22
-    current-version: "14.0.2"
+    last-reviewed: 2026-03-28
+    current-version: "14.0.3"
     upstream-source: https://codeberg.org/forgejo/forgejo/releases
-    notes: Installed via Homebrew on indri; plan to migrate to source build
+    notes: Built from source on indri (~/code/3rd/forgejo)
 
   - name: alloy
     type: ansible