Platform inventory: every app the owner has on the platform, what it holds, and its migration state #646

Pillar: P4 Forge in a link (#590), under Just go forge (#643). One run, fresh from main. Planned: held until the owner sends the crew (#642).

Outcome. One page lists every app the owner has on git.open-platform.sh (his orgs): code, database, domains, secret names, and its state: not started, in the forge, migrating, at parity, cut over. One action per row.

Today. Origins list repositories (/settings/origins/:id/repos); nothing knows which are apps, what they hold, or where they stand.

The path: the owner wants to retire the platform and asks what is left; primary action bring the next app over; next that app's migration checklist.

Acceptance.

• [ ] /migrate/inventory reads the connected origin's repositories and, per repository, detects an app (forge.json or the platform's deploy files), a Postgres database, domains and secret names (names only, never values).
• [ ] State per row from the forge's own records (migrated repo, migration mode, at parity, cut over).
• [ ] One action per row: Bring into this forge (migration mode, #M1) or Into a new forge (spawn config, #M6).
• [ ] Minimal, not bare: one primary next action; looks of the path at phone and desktop widths on the pull.

Done means reachable:

• Page: /migrate/inventory, reached from the migrate page
• MCP: inventory returns the same rows
• Test: detection on fixtures; states; secret values never read
• Look: the inventory with three apps

Removes / says what it removes: the migrate page's bare repository picker gives way to the inventory for connected origins; say what moves.

Start from: src/origins/, src/web/pages/migrate.ts, src/web/pages/origins.ts, src/actions/migrate.ts.

Must not touch: the release workflow, the chart, the old platform's repositories (read only).

Live triage (automatic, not written by a person): filed under P4 Forge in a link, which it names.