The operator sees a forge's refused first asks: the last 20 on /forges, with the plain reason #11526

Second half of #11462: what a stranger tried and why it was refused, readable afterwards.

Done:

• [ ] /forges (admin only) shows a short section "Refused first asks": time, who, the ask as escaped text, the reason; empty state is one quiet line
• [ ] The forge's MCP forges tool (or the closest existing one; no new tool, see docs/MCP.md) returns the same rows under a kind; bun test test/mcp-size.test.ts passes
• [ ] A test: an admin sees the rows, a non-admin gets no section, markup in an ask stays text
• [ ] docs/features/first-ask.md says where refusals are read and that they are capped at 20 per person per hour and kept 30 days
• [ ] bun scripts/design-lint.ts passes

Files: the /forges page module in src/web, its MCP tool, docs/features/first-ask.md, one test file. Risks: never show the email or claim code; keep the page under its budget (one indexed query).

Parked by the crew: the check stayed red through 2 automatic tries (pull #11538 closed; its branch scout/11526-the-operator-sees-a-forge-s-refused-firs at 87787c8eaf00 keeps the work so far). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

try 1: docs/features/first-ask.md, src/core/first_ask_refusals.ts, src/http/mcp/tools/forges.ts, src/web/pages/forges.ts, test/forges-refused.test.ts try 2: no files changed try 3: no files changed

Parked by the crew: the check stayed red through 2 automatic tries: each page stays inside its first-view budget (pull #11543 closed; its branch scout/11526-the-operator-sees-a-forge-s-refused-firs at 67ac3360783f keeps the work so far).

Parked twice since a person last spoke here, so it is the planner's now. Every reason:

1. the check stayed red through 2 automatic tries (pull #11538 closed; its branch scout/11526-the-operator-sees-a-forge-s-refused-firs at 87787c8eaf00 keeps the work so far)
2. the check stayed red through 2 automatic tries: each page stays inside its first-view budget (pull #11543 closed; its branch scout/11526-the-operator-sees-a-forge-s-refused-firs at 67ac3360783f keeps the work so far)

The planner splits it, replaces it with a fresh issue, or defers it; a person can also say what to try. Nothing starts here until then, and the board lists it.

try 1: docs/features/first-ask.md, src/core/first_ask_refusals.ts, src/http/mcp/tools/forges.ts, src/web/pages/forges.ts, test/forges-refused.test.ts try 2: docs/ORIGINS.md, docs/RECOVERY.md, docs/features/rotate-secret-key.md, scripts/rotate-secret-key.ts, src/kernel/secret.ts, test/rotate-secret-key.test.ts try 3: no files changed

Split into #11555 (the refused asks on their own admin page, /forges/refused, linked by one line from /forges, so /forges keeps its first-view budget, which is what failed the second try) and #11556 (the MCP forges tool returns the same rows under a kind).