checkpoint: multi-repo Gitea ingestion, per-project repos, rotation anchor_sha fix

Pre-existing uncommitted work found at session start: rotation now emits
anchor_sha on TaskReleased (previously silently dropped by store.Append
validation), multi-repo Gitea provider support, per-project git worktree
roots, and associated test coverage. Committing as a checkpoint before
starting remediation work tracked in AUDIT.md.

internal/admin/admin_test.go

@@ -73,7 +73,7 @@ func TestSubscribeEmitsCursorAndEvent(t *testing.T) {
 		t.Fatal(err)
 	}
 	p, _ := json.Marshal(map[string]any{"source": "test", "external_id": "1", "project": "p"})
-	if err := s.Append(domain.Event{ID: "e", TaskID: "t", Type: "TaskCreated", Version: 1, Payload: p}); err != nil {
+	if err := s.Append(domain.Event{ID: "e", TaskID: "t", Type: "TaskCreated", Version: 1, Payload: p, Surface: string(authz.System)}); err != nil {
 		t.Fatal(err)
 	}
 	h := (&Server{Store: s}).Subscribe