Add read-only Git mirrors on git.progmasoft.com

Tala and its tools are no longer developed (2026-11-10), and tala.run,
talac.tala.run, talafmt.tala.run and talalint.tala.run lead to a notice
that answers 503. The catalog still offered Tala, talac, talafmt and
talalint with "Visit the site" buttons into that notice, and described
Tazel as the build system of Tala.

- Tala, talac, talafmt and talalint leave the catalog in all four
  languages, as Xide did; their product pages answer 404.
- The catalog names Tazel and Catch3.
- Tazel is described as it is now: it builds C, C++, Objective-C,
  Objective-C++ and Zig from MODULE.kts and BUILD.kts, finds Clang, GCC
  and zig cc, builds for other triples, is incremental per action, and
  runs commands of tazel_custom.txt. Nothing it does not do yet (ViGet
  packages, plugins) is promised.
- The site tests list the two products and route through them.

Answers the review of website#58, which found the product links leading
into the closed sites.

- git-http-backend no longer exports every directory under the mirror
  root: GIT_HTTP_EXPORT_ALL is gone, git-mirror marks each listed mirror
  with git-daemon-export-ok, and a mirror taken off the list loses the
  mark and is deleted on the next run. Tried live: an unlisted bare
  repository answered 404 and was removed by the next run.
- git-mirror checks git ls-remote before it reads the default branch
  and fails the run when the lookup fails.
- The README explains the /usr/bin spelling of the fcgiwrap label (an
  equivalence of /usr/sbin), the stock label of /srv/*/www, and where
  the DNS record is kept.

git.progmasoft.com shows the public repositories under development
(tazel, tazelish, tazel.net, catch3, progmasoft-cpp, progmaweb, website)
as read-only mirrors with cgit, and serves clones over smart HTTP, such
as git clone https://git.progmasoft.com/tazel. GitHub stays where
development happens; private and archived repositories are not mirrored.

ops/git holds what runs on the server:

- cgitrc, the header, footer and stylesheet: the look of progmasoft.com
  (its tokens, the four-tile brand with "Git" beside it, the dark
  footer), light like its default, no scripts, no rendered READMEs.
- git-mirror.sh with git-mirror.service/.timer: every ten minutes, as
  gitmirror, branches and tags only from GitHub, pruned, the default
  branch followed, repacked with a bitmap when something changed.
- fcgiwrap@cgit drop-ins: cgit and git-http-backend run as cgit with
  systemd sandboxing (no network, read-only system, exposure 0.7), on
  a socket only nginx can open.
- selinux/progmasoft_cgit.te: fcgiwrap runs in httpd_t and the two
  CGIs move into git_script_t; the module allows only that move under
  the NoNewPrivileges that the sandboxing sets.
- nginx/git.conf: HSTS, a content security policy without scripts,
  per-address request and connection limits, 403 for receive-pack and
  the dumb protocol, buffered clones, and the inline handlers of cgit's
  menus removed.

ops/README.md describes the files, the labels, and why the name is not
behind the Cloudflare proxy: through it a clone of catch3 never reached
the client.

Deployed and checked live: every page answers 200, unknown ones 404,
full clones of tazel, progmaweb and catch3 work, a push answers 403,
no SELinux denials, no console errors, no horizontal scroll at 390 px.

Rate-limit sign-in by visitor behind Cloudflare and stop forwarding h2c

Remove Xide and ides.progmasoft.com

Cloudflare proxies the Progmasoft hosts, so Nginx saw a Cloudflare edge as
its peer and appended that edge to X-Forwarded-For. The API takes the last
hop as the client, so the account-auth limit (12 attempts in 3 minutes) was
counted per edge: 38 failed sign-ins from one address in a row were all
answered with 401, none with 429, and unrelated visitors behind one edge
shared a bucket.

- ops/nginx/cloudflare-real-ip.conf trusts CF-Connecting-IP only from the
  published Cloudflare ranges; a direct peer keeps its own address, so the
  header cannot be forged around Cloudflare. With it installed the 13th
  failed sign-in gets 429, a forged X-Forwarded-For changes nothing, and
  another address is not affected.
- Every proxied location forwarded the client's Upgrade header with
  "Connection: upgrade" on each request. Only a WebSocket upgrade is now
  forwarded; other requests carry no Upgrade and an empty Connection.
- c8 reached glob 13 (GHSA-3g3m-2fjr-6pw4) and minimatch 10
  (GHSA-g3hv-75wg-m249) through test-exclude; both are overridden to the
  fixed majors. pnpm audit reports nothing, coverage, lint and check pass.
- The CodeQL action pins carry their exact version comment (v4.38.2).
- ops/README.md describes the address handling and no longer names a
  script that left the repository with AI Support.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>