Problem: forge auth/warning logic was scattered through
`fetch_metadata` — per-API-call auth status checks, `_warned` flags,
and `warn_missing_cli` conditionals on every fetch.
Solution: replace `_warned` with `_auth` (cached per session), add
`is_configured()` to skip unconfigured forges entirely, extract
`check_auth()` for one-time auth verification, and strip
`fetch_metadata` to a pure API caller returning `ForgeFetchError`.
Gate `refresh` and new `validate_refs` with both checks. Rename
`gitea_backend` to `gitea_forge`.
Barrett Ruth
17774b1355