feat(forge): GitHub adapter — second implementation keeps the seam a contract (#2693, milestone 288 step 8)

ForgeAdapter is now a named base class carrying the shared plumbing
(host join, error taxonomy, contents decoding, archive, default_branch,
latest_commit); GiteaForge keeps its exact behavior and GitHubForge joins
with the real differences: api.github.com / GHE /api/v3 host mapping,
Bearer auth, a commits call for the provenance stamp (GitHub's contents
payload only carries the blob sha), and the codeload tarball redirect.

The contract grew latest_commit, and with it the cached-SHA short-circuit
in pull-time freshness: a stored provenance commit that still heads the
recorded path confirms 'current' without a content transfer — the economy
that fits pulls inside GitHub's rate limits; every surprise falls back to
the full fetch. Webhook deliveries now also accept X-Hub-Signature-256
(sha256=<hex>); the payload shape was already common. Settings card copy
covers both forges' token scopes; the kind selector already flowed from
the server.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

frontend/src/views/SettingsView.vue

@@ -2160,9 +2160,10 @@ function formatUserDate(iso: string): string {
       <section class="settings-section full-width">
         <h2>Git Forge</h2>
         <p class="section-desc">
-          Optional read-only connection to your git forge (Gitea) so snippet
-          code can be fetched and drift-checked server-side. A read-scope API
-          token is enough. Leave the kind unset to keep the integration off.
+          Optional read-only connection to your git forge (Gitea or GitHub) so
+          snippet code can be fetched, drift-checked, and coverage-measured
+          server-side. A read-scope token is enough. Leave the kind unset to
+          keep the integration off.
         </p>
         <div class="smtp-grid">
           <div class="field">
@@ -2179,6 +2180,13 @@ function formatUserDate(iso: string): string {
           <div class="field">
             <label for="forge-token">API Token (read scope)</label>
             <input id="forge-token" v-model="forge.token" type="password" class="input" />
+            <p class="field-hint">
+              Gitea: an access token with read scope on repositories. GitHub:
+              a fine-grained PAT with Contents: Read-only (or a classic token
+              with repo read). For GitHub, use
+              <code>https://github.com</code> as the base URL — or your
+              GitHub Enterprise instance's URL.
+            </p>
           </div>
           <div class="field">
             <label for="forge-webhook-secret">Webhook Secret</label>