The app links to its source, from an admin setting (#6228)

#6228 "The app offers its source: a Source link from an admin setting
(AGPL §13)". The AGPL requires a modified copy run for others over a
network to offer them its source; Forge's #2282 is the shape followed.

- Settings → General gains "Source code" (`source_url`), defaulting to
  the public repo so a stock install makes the offer. Empty hides it.
- It is an http(s)-only URL setting, refused otherwise on save, and
  `safe_link` refuses anything else again when it is published, because
  the web renders it as an href.
- /api/config carries it; the web shows "Source" beside the build number
  at the foot of the sidebar. The offline desktop's config has no such
  field, so the link stays hidden there.
- ci.yml's client-bake comments no longer call the forge private; the
  repo has been public since #2091.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.forgejo/workflows/ci.yml

@@ -332,17 +332,16 @@ jobs:
           docker builder prune --keep-storage 5g -f || true
 
       # Bake EVERY client in, on every image build, so a self-hoster gets a working
-      # app for their machine from the server holding their notes — without an
-      # account on this forge, which is private, so its release pages serve nobody
-      # but the forge's own users.
+      # app for their machine from the server holding their notes, with no trip to a
+      # release page on the forge.
       #
       # ~104 MB on top of the ~85 MB image, almost all of it the AppImage. That is
       # the price of the product being complete, and the AppImage is not
       # optional within it: it is the ONLY bundle that can replace itself in place,
       # so a server without one cannot serve in-app updates to anyone.
       #
-      # Fetched by the JOB, not by the Dockerfile: the releases are private, and a
-      # token used inside a build lands in the context or a layer.
+      # Fetched by the JOB, not by the Dockerfile, so the token it may use never lands
+      # in the build context or a layer.
       #
       # NEVER fails the build — see the script. A platform with nothing published
       # means the server advertises nothing for it and the UI hides that download,