feat(web,ui): per-provider git forge API base URL and detection URLs

Configure a default API base URL per git provider (github/gitlab/gitea)
in settings.json gitProviders, with GitHub Enterprise support (Octokit
baseUrl + device-flow web origin derived from the API base), and replace
the client-side custom-domains list with server-persisted detection URL
chips (SSH/HTTPS forms normalized to hosts). The configured API base host
auto-counts as a detection host. Settings round-trip through the existing
/api/config/settings sanitizer; the UI store hydrates from server settings
with a one-time localStorage migration.

packages/web/server/lib/gitlab/client.js

@@ -1,4 +1,4 @@
-import { getGitLabAuth, DEFAULT_GITLAB_BASE_URL } from './auth.js';
+import { getGitLabAuth, getGitLabDefaultBaseUrl } from './auth.js';
 
 // Per-request timeout for every GitLab call. GitLab REST can hang under load
 // (especially self-hosted instances); bounding each request lets the caller
@@ -113,7 +113,7 @@ export function isGitLabRateLimited() {
 // ---- Response helpers ----
 
 const joinApiUrl = (baseUrl, path) => {
-  const base = String(baseUrl || DEFAULT_GITLAB_BASE_URL).replace(/\/+$/, '');
+  const base = String(baseUrl || getGitLabDefaultBaseUrl()).replace(/\/+$/, '');
   const p = typeof path === 'string' && path ? (path.startsWith('/') ? path : `/${path}`) : '';
   return `${base}/api/v4${p}`;
 };
@@ -305,7 +305,7 @@ export function createGitLabClient({ token, baseUrl }) {
 
 function normalizeBaseForClient(baseUrl) {
   if (typeof baseUrl !== 'string' || !baseUrl.trim()) {
-    return DEFAULT_GITLAB_BASE_URL;
+    return getGitLabDefaultBaseUrl();
   }
   return baseUrl.trim().replace(/\/+$/, '');
 }