upstream: track prereleases per row; rename gitea adapter to forgejo

Most forges hand back a "latest stable" that ignores prereleases. Fine
until something ships only prereleases for a stretch — us, through
alpha, where every tag under v0.3.0 goes out as a prerelease. Against
that, /releases/latest either freezes or returns nothing, and the
dashboard reads like nothing's moving.

Add a per-row track_prereleases flag. When it's on, the forgejo adapter
walks the full release list and considers prereleases when picking the
highest version; off (the default) keeps stable-only behavior, so the
other adapters don't change. Seed our own self-row on so we stop
looking frozen.

Renamed gitea_releases to forgejo_releases while in there — the wire
format is Forgejo's, Codeberg runs it, and the old name was a misnomer.
Legacy source="gitea" rows still resolve through an alias.

README.md

@@ -116,7 +116,7 @@ The full trust model lives in [SECURITY.md](SECURITY.md), including how to repor
 
 - **Approval workflow** — updates queue for human review before anything runs
 - **Maintenance windows** — day/time gates on when installs can proceed
-- **Upstream tracking** — polls GitHub, Gitea, GitLab, Bitbucket for new releases; flags EOL drift
+- **Upstream tracking** — polls GitHub, Forgejo/Gitea/Codeberg, GitLab, Bitbucket for new releases; flags EOL drift
 - **Drift detection** — knows what should be installed vs. what is, bridges the gap into update packages
 - **Agent self-update** — SHA-256 → signature → atomic binary swap → service restart, reconciled server-side
 - **Dependency dry-run** — checks before installing, not after
@@ -144,7 +144,7 @@ The full trust model lives in [SECURITY.md](SECURITY.md), including how to repor
 - Capability-token minting for dnf/apt with Ed25519-signed token verification
 - Ed25519 key rotation and replay protection
 - Maintenance windows
-- Upstream version tracking (GitHub, Gitea, GitLab, Bitbucket, Repology, endoflife.date)
+- Upstream version tracking (GitHub, Forgejo/Gitea/Codeberg, GitLab, Bitbucket, Repology, endoflife.date)
 - Metadata pipeline: CVE details, upstream intelligence, package provenance
 - Auto-discovery bridge (Repology, container registry, exact match)
 - Agent self-update via privileged helper (zero agent sudo)