refactor(forge): simplify auth gating and rename gitea_backend

Problem: forge auth/warning logic was scattered through
`fetch_metadata` — per-API-call auth status checks, `_warned` flags,
and `warn_missing_cli` conditionals on every fetch.

Solution: replace `_warned` with `_auth` (cached per session), add
`is_configured()` to skip unconfigured forges entirely, extract
`check_auth()` for one-time auth verification, and strip
`fetch_metadata` to a pure API caller returning `ForgeFetchError`.
Gate `refresh` and new `validate_refs` with both checks. Rename
`gitea_backend` to `gitea_forge`.

doc/pending.txt

@@ -1524,7 +1524,9 @@ Configuration: ~
 Top-level fields: ~
     {close}             (boolean, default: false) When true, tasks linked to
                         closed/merged remote issues are automatically marked
-                        done on buffer open.
+                        done on buffer open. Only forges with an explicit
+                        per-forge key (e.g. `github = {}`) are checked;
+                        unconfigured forges are skipped entirely.
     {warn_missing_cli}  (boolean, default: true) When true, warns once per
                         forge per session if the CLI is missing or fails.