Migrate whynot-design npm catalog and docs to Forgejo registry

Update catalog, docs, tests, and exec_delivery comment for Forgejo npm API.

tests/test_catalog.py

@@ -97,7 +97,7 @@ def test_repo_catalog_loads_and_has_pilot():
     # org=coulomb, repo=whynot-design (not conflated); npm targets Gitea registry
     assert pilot.org == "coulomb"
     assert pilot.repo == "whynot-design"
-    assert pilot.npm["registry"].startswith("https://gitea.coulomb.social/")
+    assert pilot.npm["registry"].startswith("https://forgejo.coulomb.social/")
     assert pilot.npm["scope"] == "@whynot"
     # SECRETS-WP-0003 closeout uses the canonical State Hub decision UUID;
     # the slug-named fixture is retired to offline fallback only.

tests/test_exec_delivery.py

@@ -3,21 +3,21 @@ from secrets_engine.exec_delivery import _npm_userconfig, _registry_authkey
 
 def test_registry_authkey_strips_scheme_and_trails_slash():
     assert (
-        _registry_authkey("https://gitea.coulomb.social/api/packages/coulomb/npm/")
-        == "//gitea.coulomb.social/api/packages/coulomb/npm/"
+        _registry_authkey("https://forgejo.coulomb.social/api/packages/coulomb/npm/")
+        == "//forgejo.coulomb.social/api/packages/coulomb/npm/"
     )
     # missing trailing slash is added
     assert _registry_authkey("https://host/api/npm") == "//host/api/npm/"
 
 
 def test_npm_userconfig_writes_registry_and_token_ref_not_value():
-    registry = "https://gitea.coulomb.social/api/packages/coulomb/npm/"
+    registry = "https://forgejo.coulomb.social/api/packages/coulomb/npm/"
     with _npm_userconfig(registry, "@whynot", "NPM_AUTH_TOKEN") as path:
         body = path.read_text()
         assert f"@whynot:registry={registry}" in body
         # token is referenced via env expansion, never written literally
         assert "${NPM_AUTH_TOKEN}" in body
-        assert "//gitea.coulomb.social/api/packages/coulomb/npm/:_authToken" in body
+        assert "//forgejo.coulomb.social/api/packages/coulomb/npm/:_authToken" in body
         # file is mode 0600
         assert (path.stat().st_mode & 0o077) == 0
     # cleaned up on context exit