feat(actions): Add Actions API endpoints for workflow run management and logs (#35382)

Implements the missing REST API endpoints for Actions workflow run
management:

1. `POST /actions/runs/{run}/cancel` cancels a run and its jobs, `409`
when it already finished
1. `POST /actions/runs/{run}/approve` approves a run awaiting approval,
idempotent, `409` when it never awaited one
1. `GET /actions/runs/{run}/logs` downloads the latest attempt's job
logs as a zip archive

`ActionWorkflowRun` gains `created_at`, `updated_at` and the `jobs_url`,
`logs_url`, `artifacts_url`, `cancel_url` and `rerun_url` fields, and
now always emits `conclusion` and `head_branch`.

Cancellation is shared with the web handler in `services/actions`.

Fixes https://github.com/go-gitea/gitea/issues/35176
Fixes https://github.com/go-gitea/gitea/issues/36554

---------

Co-authored-by: Claude Sonnet 4.6 <claude-sonnet-4-6@anthropic.com>
Co-authored-by: OpenCode Agent <opencode@rossgolder.com>
Co-authored-by: Nicolas <bircni@icloud.com>
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

services/actions/cancel.go

@@ -0,0 +1,40 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"context"
+	"fmt"
+
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/models/db"
+)
+
+// CancelRun cancels a run's cancellable jobs and returns the run's post-cancellation state.
+func CancelRun(ctx context.Context, run *actions_model.ActionRun, jobs []*actions_model.ActionRunJob) (*actions_model.ActionRun, error) {
+	var updatedJobs []*actions_model.ActionRunJob
+	if err := db.WithTx(ctx, func(ctx context.Context) (err error) {
+		updatedJobs, err = actions_model.CancelJobs(ctx, jobs)
+		if err != nil {
+			return fmt.Errorf("CancelJobs: %w", err)
+		}
+		return nil
+	}); err != nil {
+		return nil, err
+	}
+
+	CreateCommitStatusForRunJobs(ctx, run, jobs...)
+	EmitJobsIfReadyByJobs(updatedJobs)
+	NotifyWorkflowJobsStatusUpdate(ctx, updatedJobs...)
+	if len(updatedJobs) == 0 {
+		return run, nil
+	}
+
+	reloaded, err := actions_model.GetRunByRepoAndID(ctx, run.RepoID, run.ID)
+	if err != nil {
+		return nil, fmt.Errorf("GetRunByRepoAndID: %w", err)
+	}
+	NotifyWorkflowRunStatusUpdate(ctx, reloaded)
+	return reloaded, nil
+}