Closes #6137.

The hand and skill registry source defaulted to GitHub with no way to switch to Codeberg from the UI — the backend `registry.registry_host` config (added in #6095 / #6103 for the Codeberg-hosted registry) was only reachable by hand-editing config.toml.

This adds a compact source selector to the Hands page header, wired through the existing config query/mutation hooks:
- Reads `registry.registry_host` via `useFullConfig()`; maps unset/`https://github.com` to GitHub and `https://codeberg.org` to Codeberg.
- Writes via `useSetConfigValue({ path: "registry.registry_host", value })` — GitHub clears it to null (the default), Codeberg sets the Codeberg base URL. The mutation already invalidates the config cache, so the control reflects the persisted value.
- A pre-existing custom forge URL (set out-of-band in config.toml) is shown as a read-only "Custom (host)" option so it is never silently misrepresented as GitHub/Codeberg; switching to GitHub/Codeberg from there still works.
- Surfaces `restart_required` from the set response in the success toast.

No backend changes — the field, the GET /api/config and POST /api/config/set routes, and the GitHub-vs-Forgejo URL handling in registry_sync all already exist.

i18n: new `hands.registry_source*` keys added to en, zh, uk (locale parity check passes).

Verification: dashboard `pnpm typecheck`, `eslint` (0 errors), `i18n-parity`, and `vitest run src/pages/HandsPage.test.tsx` (15/15, incl. 3 new selector tests: default GitHub, switch-to-Codeberg writes the host, switch-back clears to null) all pass.

…mment, remove shadowing aria-label

Multi-line JSDoc on RegistrySourceSelector contained issue-number refs
and described what the code does — both prohibited by project comment
rules.  The two-line inline comment for the custom-host option exceeded
the one-line-max rule.  The aria-label on the <select> was redundant
because the <label htmlFor> already supplies the accessible name;
keeping both caused aria-label to silently shadow the programmatic
label association.

Addresses review findings on the registry-source selector, all in code this branch introduced.

- Explicit `registry_host = "https://github.com"` is no longer masked as the GitHub option. registry_sync treats any `Some(host)` as the Forgejo archive scheme (`/archive/{branch}.tar.gz`, prefix `{repo}/`), which does not match GitHub's tarball layout — so an explicit github.com is a broken value distinct from the `null` default. It now surfaces as `Custom (...)`, and picking GitHub clears it to `null` to fix it. Previously the dropdown showed "GitHub" as if healthy and `next === current` made the GitHub option a no-op, so the bad value was unfixable from the UI.
- The control is now disabled during the post-write refetch (`isFetching`) and on a config-read error (`isError`), not only on `isLoading`/`isPending`. This stops the controlled `<select>` snapping back to the stale value before the invalidated query resolves, and prevents a stray click from overwriting a real config with `null` when the current value could not be read.
- The read-only custom `<option>` is no longer `disabled`: a controlled `<select>` whose value points at a disabled option is undefined across browsers (and warns in React). Re-selecting custom is a no-op via the existing `handleChange` guard.
- A failed live reload (`reload_error` in the set response) now toasts an error instead of a misleading success — the value persisted but is not in effect, mirroring ConfigPage.

Tests: +5 (explicit-github→custom + clears to null, disabled on error, disabled during refetch, reload_error→error toast, restart_required toast). The test harness now uses a stable addToast spy and captures the mutation's onSuccess/onError so the toast branches are actually exercised. typecheck, eslint (0 errors), and vitest (20/20) pass.

Not changed: a mixed-case/trailing-slash custom Codeberg URL (e.g. "https://Codeberg.org/") reads correctly as Codeberg but is not rewritten to the canonical host — that is a backend host-normalization concern in registry_sync, out of scope for this selector.