GitLab: show CI checks for MR-only pipelines and fork MRs

[v0id3r]

Problem

The CI checks badge shows "No checks" for GitLab MRs in two common setups:

1. MR-only pipelines. The backend queries GET /projects/:id/pipelines/latest?ref=<branch>, but detached / merged-results MR pipelines run on refs/merge-requests/:iid/* and are never found by branch name.
2. MRs from forks. The badge never even created a query (enabled = !isFork && !isMerged) — a restriction motivated by the GitHub check-runs API that does not apply to GitLab. Even without the flag, jobs would be requested from the target project while fork pipelines run in the source project.

Approach

• but-gitlab: split job pagination out of list_pipeline_jobs_for_ref (behavior unchanged) and add list_pipeline_jobs_for_open_mr: resolve the branch's open MR, re-fetch it via the single-MR endpoint for head_pipeline (list responses omit it), and list jobs from the project that owns the pipeline — by numeric id, since a fork's owner/repo path is unknown.
• but-forge: when the ref path returns no jobs, fall back to the MR path. No open MR / no head pipeline is an authoritative empty result; MR-lookup 403/404 maps to an unresolved ref (cache preserved, "No checks"); other errors surface on the badge. head_sha is now filled from the pipeline SHA (previously always empty for GitLab).
• Desktop: the badge's fork block now applies only where the forge cannot serve fork checks (forkBlocksChecks = isFork && !isGitLab); GitHub behavior is unchanged.

Deliberately unchanged

• Source priority: pipelines/latest?ref= remains the primary source; the MR head pipeline is only a fallback when it is empty. Making it primary would silently change badge contents after force-pushes for branch-pipeline users.
• Cache key: still the branch name. warm_ci_checks_cache stale cleanup and cache-only but status depend on it.

Testing

• Unit tests for MR selection, job normalization (incl. numeric-project URL synthesis), and the head_sha mapping; cargo test -p but-gitlab -p but-forge, clippy -D warnings, desktop vitest and svelte-check all green.
• The network path has no mock-server coverage in-repo. Manually verified against a live self-hosted GitLab: pushing to a branch with an open MR (MR-only pipelines) flips the badge to "Running" and follows the pipeline to its terminal state. Remaining scenarios (fork MRs, token without read_api) were exercised only via the unit-tested selection/error paths.