A page's uncaught script errors are counted like CSP violations, so a stranger's /claim names its own console errors #11447

Replaces #11418: twice a builder read /claim and a spawned forge's / against the CSP and found nothing, but neither could run a browser. Make the browser report instead, so a real visit names what breaks.

Done looks like

• [x] The beacon (src/web/beacon.ts) listens for error and unhandledrejection and sends at most 5 per page view: the page path, the script's path (same origin only, no query) and line, and the message cut to 120 characters. It honours Do-Not-Track and forge_measure=off like the rest of the beacon
• [x] The server keeps them like src/http/csp_report.ts keeps violations: bounded body, known shape or 4xx, one count per page + script + line + message per UTC hour, rows a day bounded, old days dropped, anonymous callers rate limited; securityFloor on every answer
• [x] /security lists them beside the CSP violations (page, where, message, count, last seen), and the MCP answer that names CSP violations names them too
• [x] A test: a well-formed report is counted; an oversized, wrong-type or cross-origin script report stores nothing; a page view sends no more than 5

Files expected: src/web/beacon.ts, src/http/csp_report.ts (or a sibling src/http/script_errors.ts), src/http/server.ts, src/web/pages/security.ts, test/script-errors.test.ts

Risks: storing a message that carries a user's text: cut it and keep only the first line; the beacon must stay under 2 KB.

Reviewed pull #11451 at its head: ticked The beacon (src/web/beacon.ts) listens for error and unhandledrejection and sends at most 5 per page view: the page path, the script's path (same origin only, no query) and line, and the message cut to 120 characters. It honours Do-Not-Track and forge_measure=off like the rest of the beacon; The server keeps them like src/http/csp_report.ts keeps violations: bounded body, known shape or 4xx, one count per page + script + line + message per UTC hour, rows a day bounded, old days dropped, anonymous callers rate limited; securityFloor on every answer; /security lists them beside the CSP violations (page, where, message, count, last seen), and the MCP answer that names CSP violations names them too; A test: a well-formed report is counted; an oversized, wrong-type or cross-origin script report stores nothing; a page view sends no more than 5.