claim(mirror): Ph1+Ph2+Ph3 complete — mirrors created, hedgedoc tests, 9 recipes enrolled

Phase 1: Create 3 missing Gitea mirrors (lasuite-drive, mailu, mumble) via API + force-sync
  upstream main (f4135d78, 23309a1a, 9fa5e949). All 3 return 200/empty=false from Gitea API.

Phase 2: Author tests/hedgedoc/ (uptime-kuma template) — recipe_meta.py, functional/
  test_health_check.py (GET / → 200/302), functional/test_branding.py (brand markers),
  PARITY.md. Generic tiers cover install/upgrade/backup baseline.

Phase 3: Enroll 9 unenrolled recipes in nix/modules/bridge.nix POLL_REPOS:
  bluesky-pds, discourse, ghost, immich, lasuite-drive, mailu, mattermost-lts, mumble, plausible.
  Final POLL_REPOS: 20 entries (cc-ci + 19 recipes).

Gate Ph4 CLAIMED: operator must run `nixos-rebuild switch --flake .#cc-ci` on cc-ci after
Adversary-verifies Ph1+Ph2+Ph3. See STATUS-mirror.md for exact repro.

tests/hedgedoc/functional/test_health_check.py

@@ -0,0 +1,21 @@
+"""hedgedoc — health check: root path responds (200 or 302 to login/new).
+
+HedgeDoc may redirect / to /login or /new depending on auth config; either is healthy.
+"""
+
+from __future__ import annotations
+
+import os
+import sys
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "..", "runner"))
+from harness import http as harness_http  # noqa: E402
+
+
+def test_hedgedoc_root_serves(live_app):
+    """GET / → 200 or 302 (login/new redirect)."""
+    url = f"https://{live_app}/"
+    status, _ = harness_http.retry_http_get(
+        url, expect_status=(200, 302), max_wait=90, interval=5
+    )
+    assert status in (200, 302), f"GET {url} HTTP {status} (expected 200 or 302)"