A stranger reading an app sees only the app's own Server-Timing; the forge's entries (forge-lag, forge-route and the rest) go to the app's writers #11112

Intent: private by default. Today every anonymous response from an app carries the forge's own internals, for example forge-lag;dur=1620.8, forge-lookup, forge-session. That shows strangers how loaded the forge is and how long its session lookups take.

Done looks like:

• [x] On a proxied app response (src/apps/proxy.ts and src/apps/relay_wait.ts), the forge-* Server-Timing entries are added only when the reader is signed in and may write the app's repository. Everyone else gets the app's own entries untouched.
• [x] The forge's own pages keep their Server-Timing for admins and drop the lag entry for anonymous readers (src/http/server.ts withLag).
• [x] Tests: an anonymous fetch through the proxy has no forge- entry, a writer's fetch has them, and the app's own entries pass through unchanged in both cases.
• [x] First-party RUM and /system still read their numbers from the server side, not from the header. Show that nothing reads forge- from a browser (grep in the pull).

Files: src/apps/proxy.ts, src/apps/relay_wait.ts, src/http/server.ts, and a test. Risk: the owner's own debugging. Writers keep every entry.

Reviewed pull #11113 at its head: ticked On a proxied app response (src/apps/proxy.ts and src/apps/relay_wait.ts), the forge-* Server-Timing entries are added only when the reader is signed in and may write the app's repository. Everyone else gets the app's own entries untouched.; The forge's own pages keep their Server-Timing for admins and drop the lag entry for anonymous readers (src/http/server.ts withLag).; Tests: an anonymous fetch through the proxy has no forge- entry, a writer's fetch has them, and the app's own entries pass through unchanged in both cases.; First-party RUM and /system still read their numbers from the server side, not from the header. Show that nothing reads forge- from a browser (grep in the pull)..