Extract bos-settings into its own repo; add Appearance/Startup Apps/Display editors

Split out of the bos repo so a bos-settings release no longer requires a
BOS ISO release (and vice versa) — CI here publishes straight to the
[breadway] pacman repo on tag push, independent of bos's own release cadence.

Also adds real GUI editors for the Hyprland JSON config surfaces bos gained
recently (hypr/settings.json, hypr/monitors.json, hypr/autostart.json):
- Appearance panel: gaps, borders (with a real color picker), blur, shadow,
  tiling layout, and basic input settings.
- Display panel: a monitor-rule list editor alongside the existing live
  connected-monitor readout.
- Startup Apps panel: toggle/edit/add/remove the extra autostart commands.
- --page argv support for deep-linking (breadhelp's guides can now open
  bos-settings straight to a specific page).
- Fixed a stale "View keybinds cheat sheet" button pointing at a file
  deleted when breadhelp replaced bos-keybinds/bos-welcome.

.forgejo/workflows/mirror.yml

@@ -0,0 +1,21 @@
+name: Mirror to GitHub
+
+on:
+  push:
+    branches: ['**']
+    tags: ['**']
+
+jobs:
+  mirror:
+    runs-on: [self-hosted, hestia]
+    steps:
+      - name: Mirror to GitHub
+        run: |
+          set -euo pipefail
+          git clone --mirror "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" repo.git
+          cd repo.git
+          # Mirror only branches and tags (not refs/pull/*, which GitHub rejects);
+          # --prune deletes GitHub refs that no longer exist on Forgejo.
+          git push --prune \
+            "https://x-access-token:${{ secrets.MIRROR_TOKEN }}@github.com/Breadway/bos-settings.git" \
+            '+refs/heads/*:refs/heads/*' '+refs/tags/*:refs/tags/*'

.forgejo/workflows/package.yml

@@ -0,0 +1,40 @@
+name: Build and publish package
+
+on:
+  push:
+    tags: ['v*']
+
+jobs:
+  package:
+    runs-on: [self-hosted, hestia]
+    container:
+      image: archlinux:latest
+    steps:
+      # Note: no actions/checkout — the archlinux image has no Node, which JS
+      # actions require. Everything runs as shell steps and clones manually.
+      - name: Build and publish
+        env:
+          PUBLISH_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: |
+          set -euo pipefail
+          VERSION="${GITHUB_REF_NAME#v}"
+          pacman -Syu --noconfirm base-devel git rust cargo gtk4 glib2
+          useradd -m builder
+          git config --global --add safe.directory '*'
+          git clone --branch "${GITHUB_REF_NAME}" --depth 1 \
+            "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" /home/builder/src
+          cd /home/builder/src
+          git archive --format=tar.gz --prefix="bos-settings-${VERSION}/" HEAD \
+            > packaging/bos-settings-${VERSION}.tar.gz
+          SHA=$(sha256sum packaging/bos-settings-${VERSION}.tar.gz | awk '{print $1}')
+          sed -i "s/^pkgver=.*/pkgver=${VERSION}/" packaging/PKGBUILD
+          sed -i "s/^sha256sums=.*/sha256sums=('${SHA}')/" packaging/PKGBUILD
+          chown -R builder:builder /home/builder/src
+          # --nocheck: packaging builds the artifact; tests belong in a CI job.
+          su builder -c "cd /home/builder/src/packaging && makepkg -f --noconfirm --nocheck"
+          PKG=$(find /home/builder/src/packaging -name '*.pkg.tar.zst' | head -1)
+          curl -fsS -X PUT \
+            -H "Authorization: token ${PUBLISH_TOKEN}" \
+            -H "Content-Type: application/octet-stream" \
+            --data-binary "@${PKG}" \
+            "https://git.breadway.dev/api/packages/Breadway/arch/os"