OpenClaw: documents from local path, rebuild workaround, forgejo-cli

- Documents (SOUL/TOOLS/AGENTS) from path input to openclaw-documents-repo
- Flake: openclaw-documents.url = path to local clone (no SSH under sudo)
- Remove in-repo openclaw-documents; add docs/openclaw-documents.md
- openclaw.nix: activation backup + force for openclaw.json (TODO to remove)
- home.nix: add forgejo-cli
- .gitignore: openclaw-documents-repo; drop SOUL/TOOLS ignores
- AGENTS.md: OpenClaw docs ref
- TODO: remove OpenClaw activation/force bloat

Made-with: Cursor

TODO.md

@@ -1,9 +1,11 @@
 # TODO
 
-1. Create a setup/boot USB that: installs NixOS on the server with encryption and WiFi configured from the start; only required input is the server's name (e.g. sunken-ship).
+1. **OpenClaw:** Remove the activation-backup + force overrides in `nixos/home/danny/openclaw.nix`. They work around "file is in the way" / "would be clobbered" when home-manager manages `~/.openclaw/`. Prefer fixing upstream (nix-openclaw) or a cleaner approach (e.g. deploy to a different path, or let the module handle existing files).
+
+2. Create a setup/boot USB that: installs NixOS on the server with encryption and WiFi configured from the start; only required input is the server's name (e.g. sunken-ship).
    * I have a set wifi SSID/PSK, assume servers will start up and be able to reach this wifi.
    * I don't know how to go about the rest of this.
 
-2. Encrypt sunken-ship (LUKS); update hardware/config for encrypted root and boot.
+3. Encrypt sunken-ship (LUKS); update hardware/config for encrypted root and boot.
 
-3. Host telegram bot once again (for what purpose?)
+4. Host telegram bot once again (for what purpose?)