feat: report ALL errors to Forgejo — backend 4xx/5xx, unhandled exceptions, worker job failures

- main.py: RequestLoggingMiddleware reports 4xx/5xx responses and unhandled exceptions to Forgejo
- worker.py: Plugin activation failures and outbox job failures reported to Forgejo
- 401/403 are NOT reported (expected auth/permission behavior)
- All other errors (422, 404, 500, network, worker) ARE reported

app/main.py

@@ -85,11 +85,34 @@ class RequestLoggingMiddleware(BaseHTTPMiddleware):
                 traceback_str=tb_str,
                 tenant_id=tenant_id,
             )
+            # Report to Forgejo error reporter
+            try:
+                from app.plugins.builtins.forgejo_error_reporter.service import report_error_to_forgejo
+                await report_error_to_forgejo({
+                    "message": f"[Backend] {method} {path}: {exc}",
+                    "stack": tb_str,
+                    "url": str(request.url),
+                    "context": {"method": method, "path": path, "source": "backend_middleware"},
+                })
+            except Exception:
+                pass  # Never let error reporting break the request
             raise
 
         duration_ms = (time.perf_counter() - start_time) * 1000
         status_code = response.status_code
 
+        # Report 4xx and 5xx errors to Forgejo (except 401/403 which are expected)
+        if status_code >= 400 and status_code not in (401, 403):
+            try:
+                from app.plugins.builtins.forgejo_error_reporter.service import report_error_to_forgejo
+                await report_error_to_forgejo({
+                    "message": f"[Backend] {method} {path} → {status_code}",
+                    "url": str(request.url),
+                    "context": {"method": method, "path": path, "status": status_code, "source": "backend_response"},
+                })
+            except Exception:
+                pass  # Never let error reporting break the response
+
         # Try to get tenant_id from response headers or request state
         # (set by auth middleware/dependency — best-effort, never log credentials)
         record_request(