A repository's upstream setting is stored: https or http only, git:// refused, seen only by admins #3976

For: following an upstream, layer 1 of 5 (split from #3622, which tried to land all 2,300 lines of pull #3722 in one run and was parked twice). The work exists: git fetch origin refs/pull/3722/head (790ecae). Carry over only the files below, adapted to today's main. No network, no pulls, no UI.

Done:

• [ ] The migration repo_upstream (from src/core/migrations/20261020200000-repo-upstream.ts, renamed to a timestamp after main's newest) and src/core/upstream_follow.ts: read/write a repository's follow row (url, on/off, origin id, last check, checking claim column).
• [ ] upstreamUrl accepts only https: and http: and refuses git:, ssh:, file: and credentials in the URL. A test refuses each.
• [ ] repo.upstream_follow is admins in src/core/event_audience.ts. A guest-vs-admin audienceFilter test finds the URL absent for a guest.
• [ ] src/actions/migrate.ts writes the follow row for a migrated repository as #3722 does. test/migrate.test.ts passes.
• [ ] bun x tsc --noEmit and bun test test/upstream_follow.test.ts test/migrate.test.ts pass (only this layer's tests in test/upstream_follow.test.ts).

Files: the migration, src/core/upstream_follow.ts, src/core/event_audience.ts, src/actions/migrate.ts, test/upstream_follow.test.ts. Risk: migration order. If the check fails where it ran and not in the change, say so in the pull.