Add REST API proxy servers that expose service-gator functionality
via HTTP. Each forge runs on its own port to avoid route collisions
(e.g., GitHub and Forgejo both use /repos/*):

  --github-port PORT   GitHub (/api/v3/* + bare paths for gh CLI)
  --gitlab-port PORT   GitLab (/api/v4/*)
  --forgejo-port PORT  Forgejo (/api/v1/*)
  --jira-port PORT     JIRA (/rest/api/2/* + /rest/api/*)
  --rest-server ADDR   Convenience: all four on consecutive ports

Each server carries its ForgeKind and ApiService directly, so
request handling is a simple prefix strip + delegate -- no runtime
route-matching registry needed.

JIRA search requires explicit -p/--project parameters instead of
heuristic JQL parsing for authorization. Projects are validated
against scope permissions, then a project filter is prepended to
the JQL. This separates authorization data from the query language
entirely.

Permission errors use a thiserror-based ServiceError enum so that
map_error_to_status_code and tests can match on typed variants
instead of inspecting error message strings.

Assisted-by: OpenCode (Claude claude-opus-4-6)