Make my forge takes a stranger with JavaScript to the claim form already filled in; without JavaScript the answer still shows the link once #11202

Intent: the finish of #2928 in one small pull: no code to copy on the JS path, and nothing lost without JS.

Done:

• [ ] newForgeSubmit answers a stranger with a 303 to /forges/<name>/waiting#<code> only when the form says the script ran (js=1, set by the page's script) and the code is well formed; otherwise the 200 page that shows the claim link once, as today
• [ ] GET /forges/<name>/waiting is static and holds no code: a few lines of script read the fragment, clear it from the address bar, poll /forges/<name>/ready (capped), then go to the child's /claim#<code>; the status line sits under the page head with no card(), and the <noscript> line is plain text
• [ ] tests: the JS answer is a 303 with the code only in the fragment; the no-JS answer is the 200 with the link; the waiting page never contains the code
• [ ] docs/features/claim-redirect.md says what a stranger sees on the JS path, the no-JS path and the terminal path
• [ ] bun scripts/design-lint.ts is clean; looks at 360 px, light and dark

Files: src/web/pages/new-forge.ts, a new src/web/pages/forge-waiting.ts, src/http/server.ts, tests, the doc. Risk: #11172/#11173 also touch the new-forge page; rebase on whichever lands first.