feat(forge): pluggable forge abstraction + GitLab and Gitea/Forgejo/Codeberg (#1913)

* refactor(forge): forge-neutral foundation (GitHub-only)

Decouple git-hosting from GitHub behind a neutral abstraction (issue #1616), GitHub-only for now; existing GitHub behaviour is unchanged.

- Forge manifest, neutral ForgeService contract, forge registry + resolver, and a client forge-module registry.
- GitHub code renamed to the neutral shape; PR/Issue attachment wording preserved.
- forge.search.response enums parse tolerantly (unknown kind/auth state degrade instead of breaking the client).
- createPullRequest reports typed CLI/auth errors instead of a generic message.
- forge-resolver host/remote caches are LRU-bounded.
- Forge host trust is explicit: only a known cloud host or a CLI-authenticated host is ever talked to; an unauthenticated GitHub Enterprise host fails resolution instead of routing to github.com.
- Docs: forge-providers guide, glossary and i18n forge-copy conventions, architecture and rpc-namespacing terminology.
- Vitest React Native mocks (unistyles, svg, linking, lucide) consolidated into shared aliased test-stubs.

* feat(forge): GitLab adapter, forge-aware UI, pipelines and approvals

GitLab adapter over the glab CLI on the neutral contracts: MR status, forge-aware UI, pipeline tree, and N-of-M approvals.

- threadIsResolved is part of the neutral timeline item.
- Pipeline load failures show an error instead of an empty section.
- Manual pipeline jobs render as pending.
- Fork/detached MR head pipelines are fetched by MR iid (glab ci get --merge-request).

* feat(forge): Gitea family adapter (Gitea, Forgejo, Codeberg)

One adapter over the tea CLI serving Gitea, Forgejo, and Codeberg on the neutral contracts.

- CI status aggregates commit statuses and Actions runs together.
- Gitea's terminal "warning" state maps to failure on server and client.
- Gitea Actions check details are reachable from the PR pane by workflowRunId.

* refactor(forge): localize compatibility handling

* test(forge): expect normalized GitLab facts

---------

Co-authored-by: Mohamed Boudra <boudra.moha@gmail.com>

packages/app/src/git/forge-url.ts

@@ -0,0 +1,127 @@
+/**
+ * Forge-neutral web URL builders for "Open on <forge>" actions (a file blob or a
+ * branch tree). The host comes from the workspace remote — not a hardcoded
+ * cloud host — so self-hosted and Enterprise instances link correctly. Each
+ * forge contributes a small URL grammar (the path infixes and line-anchor
+ * format); an unknown forge has no grammar and yields null, so the action is
+ * simply absent rather than wrong.
+ *
+ * URL grammar lives on each client forge module. The repo identity and host
+ * both ride the manifest's `cloudHosts` only to canonicalize a cloud SSH alias
+ * (e.g. ssh.github.com -> github.com); a self-hosted host is used as-is.
+ */
+import { getForgeDefinition } from "@getpaseo/protocol/forge-manifest";
+import { normalizeHost, parseGitRemoteLocation } from "@getpaseo/protocol/git-remote";
+import { getClientForgeLogicModule } from "@/git/forges";
+
+export interface ForgeBlobUrlInput {
+  remoteUrl: string | null | undefined;
+  branch: string | null | undefined;
+  path: string | null | undefined;
+  lineStart?: number;
+  lineEnd?: number;
+}
+
+export interface ForgeBranchTreeUrlInput {
+  remoteUrl: string | null | undefined;
+  branch: string | null | undefined;
+}
+
+interface ForgeWebLocation {
+  host: string;
+  repo: string;
+}
+
+/**
+ * Web host + repo path from a remote. The host is the remote's host, except a
+ * cloud SSH alias (a non-first entry in the forge's `cloudHosts`, e.g.
+ * ssh.github.com) is canonicalized to the forge's web host (`cloudHosts[0]`).
+ * Self-hosted hosts are returned untouched. The repo path supports nested
+ * groups (e.g. GitLab subgroups) since it is the full remote path.
+ */
+function isValidRepoPath(path: string): boolean {
+  const segments = path.split("/").filter((segment) => segment.length > 0);
+  if (segments.length === 0) {
+    return false;
+  }
+  return !segments.includes("..");
+}
+
+function resolveForgeWebLocation(
+  forge: string,
+  remoteUrl: string | null | undefined,
+): ForgeWebLocation | null {
+  if (!remoteUrl) {
+    return null;
+  }
+  const location = parseGitRemoteLocation(remoteUrl);
+  if (!location || !isValidRepoPath(location.path)) {
+    return null;
+  }
+  const cloudHosts = getForgeDefinition(forge)?.cloudHosts;
+  const webHost =
+    cloudHosts && cloudHosts.length > 0 && cloudHosts.map(normalizeHost).includes(location.host)
+      ? normalizeHost(cloudHosts[0])
+      : location.host;
+  return { host: webHost, repo: location.path };
+}
+
+function encodeBranch(branch: string): string {
+  return branch.split("/").map(encodeURIComponent).join("/");
+}
+
+function normalizeBlobPath(path: string | null | undefined): string | null {
+  const segments: string[] = [];
+  const trimmed = path?.trim().replace(/\\/g, "/").replace(/^\/+/, "");
+  if (!trimmed) {
+    return null;
+  }
+  for (const segment of trimmed.split("/")) {
+    if (!segment || segment === ".") {
+      continue;
+    }
+    if (segment === "..") {
+      if (segments.length === 0) {
+        return null;
+      }
+      segments.pop();
+      continue;
+    }
+    segments.push(segment);
+  }
+  return segments.join("/") || null;
+}
+
+export function buildForgeBranchTreeUrl(
+  forge: string,
+  input: ForgeBranchTreeUrlInput,
+): string | null {
+  const grammar = getClientForgeLogicModule(forge)?.urlGrammar;
+  const location = resolveForgeWebLocation(forge, input.remoteUrl);
+  const branch = input.branch?.trim();
+  if (!grammar || !location || !branch || branch === "HEAD") {
+    return null;
+  }
+  return `https://${location.host}/${location.repo}${grammar.treeInfix}${encodeBranch(branch)}`;
+}
+
+export function buildForgeBlobUrl(forge: string, input: ForgeBlobUrlInput): string | null {
+  const grammar = getClientForgeLogicModule(forge)?.urlGrammar;
+  const location = resolveForgeWebLocation(forge, input.remoteUrl);
+  const branch = input.branch?.trim();
+  const filePath = normalizeBlobPath(input.path);
+  if (!grammar || !location || !branch || branch === "HEAD" || !filePath) {
+    return null;
+  }
+  const encodedPath = filePath.split("/").map(encodeURIComponent).join("/");
+  let url = `https://${location.host}/${location.repo}${grammar.blobInfix}${encodeBranch(branch)}/${encodedPath}`;
+  if (input.lineStart && input.lineStart > 0) {
+    url += grammar.lineAnchor(input.lineStart, input.lineEnd);
+  }
+  return url;
+}
+
+/** Whether the forge has web URL builders (i.e. a known URL grammar). */
+export function hasForgeWebUrls(forge: string): boolean {
+  return getClientForgeLogicModule(forge)?.urlGrammar !== undefined;
+}