Make the landing page introduction editable in place

Why

The landing page’s heading and prose were config-only. Changing either meant editing vole.toml on the host and restarting, and the packaged service cannot write that file (ProtectSystem=strict), so the one piece of custom text an instance has was the one thing an instance admin could not edit in the browser.

This makes the introduction part of the instance’s own data and editable from the page it appears on.

Scope

• Add forge/intro, a one-row store in users.db (instance_intro), so the text lives with the roster and travels with vole admin account backup.
• Add an Introduction card to the home page with a pencil for instance admins. The editor opens on the same page (/?edit=1), saves with POST /{$}, and renders through the existing goldmark/bluemonday path.
• Audit each save as web.home.intro; an empty body removes the card, and a rejected save reopens the editor with the submitted text intact.
• Keep the original home layout: heading strip, introduction card, then the repository grid beside the Latest rail.
• Restore instance_name as the heading, with its sample config, Admin configuration row, docs and cloud-init INSTANCE_NAME plumbing.
• Remove instance_tagline, the per-card latest-commit line, the old repository/activity summary line, the repository search bar, and the top languages block from the home page.

Acceptance criteria

• An instance admin can write or clear the introduction without touching the config file or restarting.
• A visitor sees the rendered introduction, sanitized the same way an issue body is; nothing in it can inject script.
• A non-admin never sees the pencil or the editor, and cannot POST the form.
• Clearing the introduction removes the card for visitors and leaves the admin’s invitation card in place.
• instance_name names the heading; an unset value shows Vole.
• The home page has no search bar, no top-languages block, and no tagline.

Testing

./vole workflow run verify on this branch: formatting, vet, build, license and NOTICE checks, govulncheck, packaging, deployment-file checks, markdown links, and the full -race test suite all pass. New coverage lives in forge/intro/intro_test.go and server/landing_test.go (editor, save, audit, sanitization, clear, admin-only, rejected save keeps text, hidden on search).