A refused host is said out loud on the app page, and allowing it is one switch #10456

A refused host is said out loud, and allowing it is one switch. The owner: "I'm glad Hugging Face is blocked at first, but nowhere am I alerted that this is the issue, and it should be as simple as flipping a switch to allow it."

What happened: trevato/sandbox-game fetches its model catalog from huggingface.co. With cells.egress=enforce, the forge's egress proxy (src/apps/egress.ts) refused it because forge.json declares no egress. The app showed "Loading the catalog…" forever, and nothing anywhere told the owner why.

Done when:

• Logged once, counted. Every refused egress is recorded per app with the host, port, first and last time, and a count, deduplicated. It's never a log flood.
• Said where he looks. On the app's page, a single calm line: "Blocked: huggingface.co (14 tries, last 2 min ago)". There's a switch beside it: Allow.

- The same line goes to his notifications the first time a host is refused. - The crew's brief for that app names refused hosts, so a builder sees the cause at once.

• The switch. Allow adds the host to the app's allowed list and takes effect within seconds, with no redeploy. It lands as a commit to forge.json egress (author: the owner) so the repo stays the truth, and it applies before the commit merges.

- Wildcards are offered only for the redirect hosts actually seen (for example the *.hf.co CDN). - Private, LAN and tailnet destinations still need the site admin's yes, as they do today. - Deny and "forget" are one tap too.

• Tests. A refused host appears on the app page and in notifications. Allow makes the next request pass without a redeploy. A LAN address still can't be allowed by an app owner who isn't the admin.

Parked by the crew: the check stayed red through 2 automatic tries (pull #10459 closed; its branch scout/10456-a-refused-host-is-said-out-loud-on-the-a at 03bf5ee7726e keeps the work so far). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.