The app links to its source, from an admin setting (#6228)

#6228 "The app offers its source: a Source link from an admin setting
(AGPL §13)". The AGPL requires a modified copy run for others over a
network to offer them its source; Forge's #2282 is the shape followed.

- Settings → General gains "Source code" (`source_url`), defaulting to
  the public repo so a stock install makes the offer. Empty hides it.
- It is an http(s)-only URL setting, refused otherwise on save, and
  `safe_link` refuses anything else again when it is published, because
  the web renders it as an href.
- /api/config carries it; the web shows "Source" beside the build number
  at the foot of the sidebar. The offline desktop's config has no such
  field, so the link stays hidden there.
- ci.yml's client-bake comments no longer call the forge private; the
  repo has been public since #2091.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_settings.py

@@ -1,4 +1,4 @@
-from inkwell.settings import MAX_BODY_MB, REGISTRY, validate_updates
+from inkwell.settings import MAX_BODY_MB, REGISTRY, safe_link, validate_updates
 
 
 def test_registry_has_expected_keys():
@@ -70,6 +70,23 @@ def test_the_public_address_is_an_http_url_without_a_trailing_slash():
     assert clean == {} and error
 
 
+def test_the_source_link_takes_only_an_http_url():
+    assert validate_updates({"source_url": "https://git.example.test/me/inkwell/"}) == (
+        {"source_url": "https://git.example.test/me/inkwell"},
+        None,
+    )
+    assert validate_updates({"source_url": ""}) == ({"source_url": ""}, None)
+    clean, error = validate_updates({"source_url": "javascript:alert(1)"})
+    assert clean == {} and error
+
+
+def test_a_link_that_is_not_http_is_never_published():
+    """A stored value reaches an href; one that bypassed validation must still not."""
+    assert safe_link("https://git.example.test/me/inkwell") == "https://git.example.test/me/inkwell"
+    assert safe_link("javascript:alert(1)") == ""
+    assert safe_link("") == ""
+
+
 def test_choice_labels_name_every_choice():
     """The UI pairs labels with choices by position, so a label list of another length
     would put one choice's name on another."""