A forge link says when it ends and its sender revokes it in one tap #10725

Intent: a sender gives a client one link and can take it back; the client sees a plain "this link has ended" page, not an error.

Done when:

• [x] The list of links a sender has sent shows each link's state (open, used, ended) and a Revoke action, with the same words as the MCP action (no new tool).
• [x] A revoked or expired link answers a plain-words page with status 410 and sets no session.
• [x] Revoking is same-origin checked, receipted, and undoable for the first minute.
• [x] A test covers use-then-revoke, revoke-then-use (410) and a cross-origin revoke (refused).

Files: where one-link forge invites live under src/spawn/ or src/auth/, the sent-links page under src/web/pages/, src/http/mcp.ts, a new test. Risks: read how the link is stored before changing it; do not log the link's secret; never touch the release workflow or the chart.

Reviewed pull #10830 at its head: ticked The list of links a sender has sent shows each link's state (open, used, ended) and a Revoke action, with the same words as the MCP action (no new tool).; A revoked or expired link answers a plain-words page with status 410 and sets no session.; Revoking is same-origin checked, receipted, and undoable for the first minute.; A test covers use-then-revoke, revoke-then-use (410) and a cross-origin revoke (refused)..