The forge mints its own API token with the admin account the vault delivers

The runtime beside the forge served 0 tools: GiteaClient.fromEnv required a token
(settings or MESH_GITEA_TOKEN), nobody had one to give — the mesh raised the forge —
and putting one in settings would store a secret in plaintext in the inventory. So
the fifteen tools registered nothing and the watcher logged "not watching".

What the mesh does deliver is the admin account: a login the manifest names and a
password the vault minted and the host unsealed into a file (ADR 0086). That is
enough to mint a token, so the module does (hq issue 100, the forge's tools):
POST /users/{admin}/tokens over basic auth, scoped to write:repository and
write:issue — the least the tools and the repo watcher need — kept at 0600 in the
module's own state (/var/lib/mesh/gitea/state, a new directory resource the runtime
mounts writable), read back on the next start, and minted afresh when the forge
answers 401 to it or the kept file is gone. A forge whose data came from the
predecessor has no mesh-admin: that is reported in plain words on every poll until
it clears, once per reason, not crash-looped. A configured token still wins and is
never minted over.

The mint happens on the first call, not at registration: a contributor is
synchronous, and a forge not yet answering must not keep the runtime from serving.
One source per kept file in a process, or the watcher and the tools would each
renew on a 401 and drop the other's token by name.

modules/gitea/index.ts

@@ -16,7 +16,9 @@
 import { emit } from "@novox/mesh-sdk/events";
 import { GiteaClient } from "./client.js";
 
-// Without a token there is nothing to watch; log and stay quiet rather than crash the runtime.
+// Without a way to a token — configured, or mintable with the admin account (token.ts) — there is
+// nothing to watch; log and stay quiet rather than crash the runtime. With one, the first poll mints
+// or reuses the token, so the runtime's start also shows what it did about it.
 let gitea: GiteaClient | null = null;
 try {
   gitea = GiteaClient.fromEnv();
@@ -49,8 +51,21 @@ async function pollRepos(client: GiteaClient): Promise<void> {
 
 if (gitea) {
   const client = gitea;
+  // A poll that fails says so once, not once a minute: the same reason repeating (the forge not up
+  // yet, the admin account refused on a restored forge) is one fact, and a recovery is worth a line.
+  let failing: string | null = null;
   const tick = (fn: () => Promise<void>, everyMs: number): void => {
-    const run = (): void => void fn().catch((err) => console.error(`[gitea] ${err}`));
+    const run = (): void =>
+      void fn()
+        .then(() => {
+          if (failing !== null) console.log("[gitea] watching again");
+          failing = null;
+        })
+        .catch((err) => {
+          const why = err instanceof Error ? err.message : String(err);
+          if (why !== failing) console.error(`[gitea] not watching until this clears — ${why}`);
+          failing = why;
+        });
     setInterval(run, everyMs);
     run();
   };