ci: run CI only on Forgejo and delete the never-run GitHub workflows (WS-D)

The repository has Forgejo and GitLab remotes but no GitHub remote, so
nothing under .github/workflows ever ran - including the daily Payple
renewal job, which means Payple subscriptions were not being renewed.

- Port payple-renew (daily cron + manual dispatch) to Forgejo. Requires the
  Forgejo secrets SUPABASE_URL and CRON_SECRET.
- Port the CI checks (quality incl. version:check and contract:check, build,
  mobile quality, edge functions, API tests) to .forgejo/workflows/ci.yml.
  macOS and Android emulator jobs are dropped: no macOS runner here, and the
  signed Android release stays on GitLab mobile-production-release.
- Keep one site deploy workflow (Linux, Cloudflare Pages); remove the
  manual Windows duplicate. The mobile release boundary self-test runs there.
- Release verifiers read the Forgejo/GitLab workflows, fail if .github
  workflows come back, and check the rewritten site offers no mobile package.

Policy: docs/REFACTOR_POLICY.md Wave 3, W3-7 and W3-8.

.forgejo/workflows/release.yml

@@ -1,9 +1,8 @@
 name: release
 
 # Canonical tag-triggered desktop release built and published on Forgejo.
-# GitLab CI (.gitlab-ci.yml) and GitHub Actions (.github/workflows/release.yml)
-# remain alternate builders; all three converge on publish-forgejo-release.mjs
-# so the Forgejo feed is the single update source.
+# GitLab CI (.gitlab-ci.yml) is the legacy mirror builder; both converge on
+# publish-forgejo-release.mjs so the Forgejo feed is the single update source.
 #
 # Required repository secrets:
 #   FORGEJO_TOKEN              — PAT with write:package + write:repository