feat(agentgit): register members' SSH keys + enable git push over SSH

Make git.profullstack.com a real, key-authenticated git host for every BBS
member ("BBS membership is the git account", SSH-key auth end to end):

- forgejo.EnsureKey: register a member's SSH public key on their Forgejo
  account (idempotent, ignores the key comment). So the key they sign in to
  the BBS with is also their git push key.
- provisionGit now takes the session public key and registers it after
  ensuring the account; called on email verification AND (newly) on every
  member login, so members who predate AgentGit — or whose key wasn't
  registered yet — are backfilled automatically and off the hot path.
- setup.sh:
  - admin token scopes write:admin,read:user,write:user (the old write:admin
    alone failed userExists' /users lookup, so provisioning never worked).
  - REQUIRE_SIGNIN_VIEW=false so member profiles + public repos are viewable
    at git.profullstack.com/<name> (private repos stay private; accounts are
    still created only by agentbbs).
  - Enable Forgejo's built-in SSH server (port 2222, BUILTIN_SSH_SERVER_USER=git)
    and open the firewall, so members push to git@git.profullstack.com:2222.

Verified live: all members provisioned, git.profullstack.com/chovy serves the
profile, and a push over ssh://git@host:2222 with a registered key succeeds.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

internal/forgejo/forgejo.go

@@ -84,6 +84,58 @@ func (c Config) EnsureUser(username, email string) (created bool, err error) {
 	return true, nil
 }
 
+// EnsureKey registers an SSH public key on the member's Forgejo account so the
+// key they use for the BBS is also their git push key ("BBS membership is the
+// git account"). It is idempotent: added is false when the same key material is
+// already present. A blank key is a no-op. title labels the key in Forgejo.
+func (c Config) EnsureKey(username, title, pubKey string) (added bool, err error) {
+	if !c.Configured() {
+		return false, fmt.Errorf("forgejo not configured")
+	}
+	pubKey = strings.TrimSpace(pubKey)
+	if pubKey == "" {
+		return false, nil
+	}
+
+	// Skip if this key (ignoring the trailing comment) is already on the account.
+	if status, resp, e := c.do(http.MethodGet, "/users/"+username+"/keys", nil); e == nil && status == http.StatusOK {
+		var keys []struct {
+			Key string `json:"key"`
+		}
+		if json.Unmarshal([]byte(resp), &keys) == nil {
+			want := keyMaterial(pubKey)
+			for _, k := range keys {
+				if keyMaterial(k.Key) == want {
+					return false, nil
+				}
+			}
+		}
+	}
+
+	body, _ := json.Marshal(map[string]any{"title": title, "key": pubKey, "read_only": false})
+	status, resp, err := c.do(http.MethodPost, "/admin/users/"+username+"/keys", body)
+	if err != nil {
+		return false, err
+	}
+	if status == http.StatusUnprocessableEntity {
+		return false, nil // key already exists (raced or comment differs)
+	}
+	if status < 200 || status >= 300 {
+		return false, fmt.Errorf("forgejo add key %q: %d: %s", username, status, truncate(resp, 200))
+	}
+	return true, nil
+}
+
+// keyMaterial returns the type+base64 of an authorized-key line, dropping the
+// optional comment so the same key compares equal regardless of how it's labeled.
+func keyMaterial(authorizedKey string) string {
+	f := strings.Fields(strings.TrimSpace(authorizedKey))
+	if len(f) >= 2 {
+		return f[0] + " " + f[1]
+	}
+	return strings.TrimSpace(authorizedKey)
+}
+
 // userExists reports whether a Forgejo user with this name is present.
 func (c Config) userExists(username string) (bool, error) {
 	status, resp, err := c.do(http.MethodGet, "/users/"+username, nil)

internal/forgejo/forgejo_test.go

@@ -93,3 +93,65 @@ func TestEnsureUserNoOpWhenExists(t *testing.T) {
 		t.Fatal("must not POST when the user already exists")
 	}
 }
+
+const aliceKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAITESTKEY alice@bbs"
+
+func TestEnsureKeyAddsWhenMissing(t *testing.T) {
+	var posted map[string]any
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch {
+		case r.Method == http.MethodGet && r.URL.Path == "/api/v1/users/alice/keys":
+			_, _ = w.Write([]byte(`[]`))
+		case r.Method == http.MethodPost && r.URL.Path == "/api/v1/admin/users/alice/keys":
+			_ = json.NewDecoder(r.Body).Decode(&posted)
+			w.WriteHeader(http.StatusCreated)
+			_, _ = w.Write([]byte(`{"id":1}`))
+		default:
+			t.Errorf("unexpected %s %s", r.Method, r.URL.Path)
+		}
+	}))
+	defer srv.Close()
+
+	c := Config{BaseURL: srv.URL, Token: "secret"}
+	added, err := c.EnsureKey("alice", "agentbbs", aliceKey)
+	if err != nil {
+		t.Fatalf("EnsureKey: %v", err)
+	}
+	if !added {
+		t.Fatal("expected added=true")
+	}
+	if posted["key"] != aliceKey {
+		t.Errorf("posted key = %v", posted["key"])
+	}
+}
+
+func TestEnsureKeyIdempotentIgnoringComment(t *testing.T) {
+	posted := false
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method == http.MethodPost {
+			posted = true
+		}
+		// Same key material, different comment — must be treated as already present.
+		_, _ = w.Write([]byte(`[{"key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAITESTKEY different-comment"}]`))
+	}))
+	defer srv.Close()
+
+	c := Config{BaseURL: srv.URL, Token: "secret"}
+	added, err := c.EnsureKey("alice", "agentbbs", aliceKey)
+	if err != nil {
+		t.Fatalf("EnsureKey: %v", err)
+	}
+	if added {
+		t.Fatal("expected added=false when key material already present")
+	}
+	if posted {
+		t.Fatal("must not POST when the key already exists")
+	}
+}
+
+func TestEnsureKeyBlankIsNoOp(t *testing.T) {
+	c := Config{BaseURL: "https://git.example.com", Token: "t"}
+	if added, err := c.EnsureKey("alice", "agentbbs", "  "); err != nil || added {
+		t.Fatalf("blank key should be a silent no-op, got added=%v err=%v", added, err)
+	}
+}