ci(forgejo): fix gitleaks artifact upload + use forgejo/upload-artifact

- gitleaks: GITLEAKS_ENABLE_UPLOAD_ARTIFACT=false (its @actions/artifact v2
  upload throws GHESNotSupportedError on Forgejo; the scan itself passes).
- swap actions/upload-artifact@v7 -> forgejo/upload-artifact@v4 (v4+ artifact
  API is unsupported on non-github.com servers).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.forgejo/workflows/ci.yml

@@ -34,6 +34,10 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}
+          # The action's SARIF artifact upload uses @actions/artifact v2, which
+          # throws GHESNotSupportedError against Forgejo. The scan itself works;
+          # disable the upload so a clean scan doesn't fail the job.
+          GITLEAKS_ENABLE_UPLOAD_ARTIFACT: "false"
       - uses: pnpm/action-setup@v6
       - uses: actions/setup-node@v6
         with:
@@ -180,7 +184,7 @@ jobs:
 
       - name: Upload screenshots on failure
         if: failure()
-        uses: actions/upload-artifact@v7
+        uses: forgejo/upload-artifact@v4
         with:
           name: visual-snapshots-diff
           path: apps/planner/.vitest-attachments/