feat(groups): host-based forge sources with optional display name

- forgeSources entries are now { host, type, name? }: the repository URL's
  hostname is matched case-insensitively against host (github.com for GitHub,
  distinct hosts for multiple Gitea instances); the footer label is the
  optional name, falling back to the host
- GroupEditor renders one row per source: host input + type select + optional
  display name (grid layout); hostname validation mirrors the server
- fix: apiFetch sends Content-Type: application/json — h3's readBody only
  parses JSON bodies with that header, so every PUT/POST from the refactored
  console arrived as a raw string and failed with 'groups must be an array'
- hardening: readJsonBody (admin + actions) JSON-parses string bodies so curl
  and older clients without the content-type header still work
- regression test: groups PUT without content-type + forgeSources round-trip
- docs: groups.md/message-format.md (en/zh), AGENTS.md, config.example.yaml

app/composables/useApi.ts

@@ -16,7 +16,15 @@ export async function apiFetch<T>(path: string, init?: RequestInit): Promise<T>
   const res = await fetch(path, {
     credentials: "same-origin",
     ...init,
-    headers: { accept: "application/json", ...(init?.headers ?? {}) },
+    // JSON in/out: h3's readBody only parses JSON bodies when the request
+    // declares application/json, and the browser defaults string bodies to
+    // text/plain — without this header every PUT/POST would arrive as a
+    // raw string and fail validation.
+    headers: {
+      accept: "application/json",
+      "content-type": "application/json",
+      ...(init?.headers ?? {}),
+    },
   });
   if (res.status === 401) {
     useAuthState().needLogin.value = true;