feat(repos): git-fingerprint-based machine-independent repo identity

Add git_fingerprint (root commit SHA-1) to managed_repos as a stable,
machine-independent identifier — identical across every clone regardless
of checkout path, remote URL, or SSH alias.

- Migration n1i2j3k4l5m6: adds git_fingerprint column + non-unique index
  (non-unique to support repos that share ancestry via forks/splits)
- GET /repos/by-fingerprint?hash=<sha>[&remote_url=<url>]: lookup by
  fingerprint; optional remote_url disambiguates shared-ancestry repos
- GET /repos/by-remote?url=<url>: fallback lookup by remote URL
- consistency_check.py --here [PATH]: auto-detects repo slug from any
  local checkout via fingerprint (falls back to remote URL), then auto-
  registers host_paths[hostname] so subsequent runs need no override
- --all now includes repos with host_paths[current_hostname], not just
  those with local_path
- fix-consistency-here / check-consistency-here Makefile targets
- Fixed _api_get bug: httpx strips query strings when params={} is passed
- Backfilled fingerprints for 14 repos on this host

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

CLAUDE.md

@@ -122,6 +122,13 @@ Every Claude Code session in this repository must follow this ritual:
    cd state-hub && make fix-consistency-remote REPO=<slug>
    ```
 
+   **On a machine where the checkout path differs from what's in the DB**, use
+   `--here` to auto-detect the slug from the git root-commit fingerprint:
+   ```bash
+   cd state-hub && make fix-consistency-here REPO_PATH=/path/to/repo
+   ```
+   This also auto-registers `host_paths[hostname]` so subsequent runs need no override.
+
 **Workplan ↔ DB sync rule (prevents ghost workstreams):**
 When creating a new workstream backed by a workplan file, **always write the file
 first, then run `make fix-consistency`** — never call `create_workstream()` /