G11 / I-4: continuous off-site mirror, and a namespace bug fixed

I-4 said 'never a one-way door' and had no implementation. Now it does.

  - ensure the GitHub counterpart exists (idempotent), then ask Gitea to keep
    it in step with sync_on_commit=True. An hourly timer means an hour of work
    can be the thing you lose, and that window is invisible until it costs you.
  - mirror status reports what is TRUE including 'we do not know'. An
    unconfigured mirror reports unconfigured, NEVER healthy — same posture as
    me-fleet.ts refusing to say 'online' when it only knows 'registered'.
  - lag past the threshold is a P2, not a shrug. A mirror nobody checks is a
    belief, not a backup, and this ecosystem already lost 37 days to a canary
    everyone assumed was fine.

Gitea owns the replication rather than a hand-rolled loop, because a background
job that fails silently is exactly how the registry's integrity refresh spent
its entire life calling a 404 and incrementing a counter instead of raising.

Also fixes a real bug I had written myself: list_versions derived the Gitea
namespace from the CALLER, which is correct only while the caller is the owner
and addresses the wrong namespace the moment a collaborator asks — surfacing as
'not found', which is the hardest kind of bug to see. Now derived from the repo,
with a test that keeps it that way.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

api/app/config.py

@@ -82,7 +82,12 @@ class Settings(BaseSettings):
     rate_grants_per_day: int = 100
     rate_force_pushes_per_day: int = 10
 
-    # ---- mirror health (I-4) ----------------------------------------------
+    # ---- mirror: I-4, never a one-way door --------------------------------
+    github_token: str = ""
+    github_owner: str = "sneakyfree"
+    # Gitea's timer, as a backstop. sync_on_commit is what actually matters:
+    # an hourly window means an hour of work can be the thing you lose.
+    mirror_interval: str = "8h0m0s"
     mirror_lag_p2_seconds: int = 3600  # env: 60 min -> P2
 
     # ---- agent grants (G5.3) ----------------------------------------------