fix: proxy forge API requests to avoid CORS, case-insensitive readme

Add /v1/forge/{source}/* proxy endpoint to the API server with an
allowlisted set of hosts. Frontend readme and language requests now
go through the proxy instead of hitting forge APIs directly (Gitea
has no CORS headers). Gitea readme fetch tries README.md, readme.md,
and Readme.md casings.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

crates/moments-api/Cargo.toml

@@ -20,3 +20,4 @@ serde.workspace = true
 serde_json.workspace = true
 chrono.workspace = true
 clap.workspace = true
+reqwest.workspace = true