fix(forge): the repo path can pick the forge, and an empty token counts as one #1131

Two findings from the review of #1124, both still on main.

A SaaS domain anywhere in the URL picks the forge

forge::detect_forge_from_url does url.contains("github.com") (and the same for gitlab.com, codeberg.org, gitea.io, bitbucket.org), so the repository path counts, not just the host. https://git.acme.com/tools/gitlab.com-exporter.git resolves to GitLab.

Since #1124 the push credential follows that resolution in auto mode, so on such a remote:

• with FERRFLOW_TOKEN set, the push username flips from x-access-token to oauth2
• with only GITHUB_TOKEN set, token_for_url returns None and the push goes out with no credential

The API side (forge_target in preview.rs) and doctor read the same function, so they had the quirk before #1124 too. git::auth had already been fixed not to do this for its own heuristic (a_repository_name_does_not_pick_the_forge, #799).

An empty token variable counts as a token

token_for_url treats GITHUB_TOKEN="" as present. That is what GITHUB_TOKEN: ${{ secrets.MISSING }} exports. It then pays a probe (up to 3 x 2s on a self-hosted host) for a credential that reaches git as an empty password. forge::resolve_token already ignores empty values.