feat(deploy): commit-status reporting to Git providers

Report deploy status back to the Git provider as a commit status
(pending/success/failure) for git-sourced workloads (static + dockerfile).

- GitProvider.SetCommitStatus on gitea/github/gitlab over the existing
  SSRF-safe client; fixed "tinyforge" context so redeploys update one row.
  postJSON returns status-code-only errors (never echoes the upstream body,
  which a hostile provider could use to reflect the auth token into the
  best-effort log line).
- Best-effort deploy hook: pending on deploy start, success/failure on
  outcome, gated on a per-workload report_commit_status flag. Never fails or
  blocks a deploy; emits nothing on the unchanged-SHA short-circuit.
- UI ToggleSwitch (create + edit) + reportCommitStatus in sourceForms.ts
  + en/ru i18n.
- Tests: per-provider state mapping + request shape; reporter gating
  (enabled/disabled/empty-SHA/nil/error-swallow).

Reviewed via go-reviewer + security-reviewer (0 CRITICAL/HIGH; one MEDIUM
body-echo log-leak fixed).

web/src/lib/i18n/en.json

@@ -1298,6 +1298,8 @@
       "staticModeDenoDesc": "— Deno runtime container with optional dynamic routing.",
       "staticRenderMarkdown": "Render markdown",
       "staticRenderMarkdownDesc": "— auto-render <code>.md</code> files as HTML pages.",
+      "sourceReportCommitStatus": "Report commit status",
+      "sourceReportCommitStatusDesc": "— report deploy status back to the Git provider as a commit status on the deployed commit.",
       "staticFoot": "The webhook secret for git push triggers lives on the workload's Webhook panel after creation.",
       "staticDetectProvider": "Detect",
       "staticDetectedOk": "Detected: {provider}",