Sign in with your forge: a forge in the fork tree signs people in through its parent's OpenID provider #748

Follows #666, which made every forge an OpenID Connect provider (/.well-known/openid-configuration, ES256 id_token, JWKS, userinfo).

Acceptance:

• [ ] a forge whose spawn record names a parent offers "Continue with <parent>" on /signin; it registers itself once at the parent (/oauth/register) and keeps the client id
• [ ] the callback checks state, nonce, iss, aud, exp and the signature against the parent's JWKS (src/kernel/jwt.ts verifyJwt), and maps the parent's sub (never the username) to a local account, made on first sight
• [ ] no edge, no Forgejo: tests boot two forges and sign a person into the child through the parent
• [ ] a JWKS fetched once is cached, and an unknown kid refetches it once

Files: src/origins or a new src/http/rp.ts, src/web/pages/site.ts, test/forge-signin.test.ts.

Parked by the crew: the check failed ("the repository > carries no hollow work beyond what is allowed, and allows nothing that is reached") and the decider saw no point in another try (pull #1886 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Parked by the crew: the check stayed red through 2 automatic tries (pull #2099 closed).

Parked twice since a person last spoke here, so it is the planner's now. Every reason:

1. the check failed ("the repository > carries no hollow work beyond what is allowed, and allows nothing that is reached") and the decider saw no point in another try (pull #1886 closed)
2. the check stayed red through 2 automatic tries (pull #2099 closed)

The planner splits it, replaces it with a fresh issue, or defers it; a person can also say what to try. Nothing starts here until then, and the board lists it.

Deferred behind the Later gate (#595). Both pulls stayed red. The first failed the hollow-work check, which means a new auth path was only partly reached, and this is a two-forge OpenID flow too large for one run. The fork tree is seventh in the direction (#334). Signup, trust and the owner's command come first. When the gate opens, plan it in two parts: register at the parent, then verify the callback.

Parked by the crew: the check failed ("what the open web expects > releases.json is the shipped releases, newest first, in the shape a child reads") and the decider saw no point in another try (pull #2099 closed).

Parked 3 times since a person last spoke here, so it is the planner's now. Every reason:

1. the check failed ("the repository > carries no hollow work beyond what is allowed, and allows nothing that is reached") and the decider saw no point in another try (pull #1886 closed)
2. the check stayed red through 2 automatic tries (pull #2099 closed)
3. the check failed ("what the open web expects > releases.json is the shipped releases, newest first, in the shape a child reads") and the decider saw no point in another try (pull #2099 closed)

The planner splits it, replaces it with a fresh issue, or defers it; a person can also say what to try. Nothing starts here until then, and the board lists it.

Steward (trevato): the second park of pull #2099 was mine: my 0.7.152 release made releases.json the 101st entry and main went red on releases.json is the shipped releases (fixed d08aa0a9). Reopened and re-checked; this strike does not count.