docs: correct admin-credentials help text

Forget does not use admin credentials. Only JobPrune builds a runner
against the admin slot (cmd/agent/main.go:622-645); JobForget runs on
the everyday runner, as the comment at main.go:517-524 states.

Also corrects the claim that leaving this blank lets everyday creds
handle prune: maintenance_dispatch.go:52-56 skips prune entirely with
'prune skipped — no admin creds' on any backend, with no fallback.

Refs #34

web/templates/pages/host_repo.html

@@ -83,9 +83,11 @@
       {{end}}
       <p class="text-[12.5px] text-ink-mid leading-[1.6] mb-4 max-w-[640px]">
         Only needed for rest-server repos that distinguish an append-only
-        user (everyday backups) from a delete-capable user (prune /
+        user (everyday backups) from a delete-capable user (prune). Note
-        forget). For S3 / B2 / SFTP / local, leave this blank — the
+        that <strong>forget</strong> always runs with the everyday repo
-        everyday repo credentials handle prune too.
+        credentials, so those must have delete authority. For S3 / B2 /
+        SFTP / local, leave this blank — but note that <strong>prune is
+        skipped entirely when this is unset</strong>, on any backend.
       </p>
       <div class="grid grid-cols-2 gap-4">
         <div>