Forge v1.0.6

Security

Hardens Forge against recent reports and related OIDC/S3 risks:

• Linear embed-detection scan (ReDoS)
• Publish orphan purge under {slug}/ with prefix guards
• Valkey requirepass in compose
• OIDC callback DB session pin + state nonce (SET NX)
• Custom-domain degraded-mode refuse outside local
• Reserved slugs / host-cache LRU (from prior PRs)

Notes

Includes merges from #96, #97, and #98.