After a GitHub migration the person chooses: leave GitHub alone, archive it, or keep it as a read-only mirror the forge pushes to #3408

Replaces part 2 of #3288.

Done:

• [ ] /migrate and the finished job page offer three choices beside the crew fields, default "leave it alone".
• [ ] "Archive" calls GitHub's PATCH /repos/{o}/{r} archived=true with the connected credential; when it lacks admin there, the page says so in plain words and the migration still succeeds.
• [ ] "Mirror" pushes to the GitHub repository after every landing, using the rules in src/origins/push-through.ts (credential as a header in env, never argv or URL).
• [ ] Test: the fake GitHub's request log shows the archive call with "archive", one push after a landing with "mirror", and no write at all with "leave alone".

Files: src/actions/migrate.ts, src/web/pages/migrate.ts, src/origins/push-through.ts if it needs a mirror target, the migrate test. Waits for #3264, which adds the GitHub connection and credential.