coe-mirror: mirror Nightmare_Eclipse Forgejo repos to pCloud

Standalone Python tool. Hits git.churchofmalware.org public API every
12h (00:00/12:00), downloads any repo HEAD whose SHA hasn't already
been snapshotted to pCloud, with local-staging fallback when the FUSE
mount is unavailable. Matrix notification stub for when the home
server is back.

Devil's-advocate findings folded into the design:
  - shutil.copy2 + size verify + unlink, not os.rename, for FUSE safety
  - no pCloud daemon auto-start (no user unit; DISPLAY=:0 unreliable);
    relies on Persistent timer + pending flush for recovery
  - two-call API path retained because the repo list response does not
    include commit.sha

Audit-driven security fixes:
  - repo names whitelist-validated (^[a-zA-Z0-9._-]+$)
  - urllib.parse.quote on all interpolated URL segments
  - same-file no-op guard in place_into_pcloud
  - existence check moved to main() so cached files don't generate
    spurious notify entries

13 pytest tests passing.

systemd/coe-mirror.service

@@ -0,0 +1,12 @@
+[Unit]
+Description=coe-mirror: mirror Nightmare_Eclipse repos to pCloud
+After=network-online.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/bin/python3 %h/tools/coe-mirror/coe_mirror.py
+WorkingDirectory=%h/tools/coe-mirror
+Nice=10
+IOSchedulingClass=idle
+StandardOutput=journal
+StandardError=journal

systemd/coe-mirror.timer

@@ -0,0 +1,12 @@
+[Unit]
+Description=coe-mirror schedule: 00:00 and 12:00 daily, with boot catch-up
+
+[Timer]
+OnCalendar=*-*-* 00,12:00:00
+Persistent=true
+OnBootSec=2min
+RandomizedDelaySec=30
+Unit=coe-mirror.service
+
+[Install]
+WantedBy=timers.target