The operator reads a forge's refused first asks on /forges/refused, linked by one line from /forges #11555

Replaces half of #11526, parked twice: adding the section to /forges itself broke its first-view budget. The rows already exist: listRefusals in src/core/first_ask_refusals.ts (#11530).

Done:

• [ ] GET /forges/refused (operator/admin only, same gate as /forges; others get the same answer /forges gives them) lists the last 20 refusals from one listRefusals call: time, who, the ask as escaped text, the reason. An empty list is one quiet line.
• [ ] /forges gains exactly one line linking to it (with the count when there are any); nothing else on /forges changes, and the first-view budget test passes unchanged.
• [ ] A test: an admin sees the rows, a non-admin is refused, <script> in an ask renders as text, and /forges links to the page.
• [ ] docs/features/first-ask.md says where refusals are read and that they are capped at 20 per person per hour and kept 30 days.
• [ ] bun scripts/design-lint.ts passes; the page's own builder is a new small file, mounted with one route line.

Files: a new src/web/pages/forges-refused.ts, the route table, src/web/pages/forges.ts (one line), docs/features/first-ask.md, test/forges-refused.test.ts. Risks: never show an email or claim code. The earlier branch scout/11526-the-operator-sees-a-forge-s-refused-firs has a start; reuse what fits, not the section on /forges.

Parked by the crew: the check stayed red through 2 automatic tries (pull #11557 closed; its branch scout/11555-the-operator-reads-a-forge-s-refused-fir at f420c437b976 keeps the work so far). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

try 1: docs/features/first-ask.md, src/http/server.ts, src/web/pages/forges-refused.ts, src/web/pages/forges.ts, test/forges-refused.test.ts try 2: no files changed try 3: no files changed

Parked by the crew: the check stayed red through 2 automatic tries (pull #11568 closed; its branch scout/11555-the-operator-reads-a-forge-s-refused-fir at 4687f1b01911 keeps the work so far).

Parked twice since a person last spoke here, so it is the planner's now. Every reason:

1. the check stayed red through 2 automatic tries (pull #11557 closed; its branch scout/11555-the-operator-reads-a-forge-s-refused-fir at f420c437b976 keeps the work so far)
2. the check stayed red through 2 automatic tries (pull #11568 closed; its branch scout/11555-the-operator-reads-a-forge-s-refused-fir at 4687f1b01911 keeps the work so far)

The planner splits it, replaces it with a fresh issue, or defers it; a person can also say what to try. Nothing starts here until then, and the board lists it.

try 1: docs/features/first-ask.md, src/http/server.ts, src/web/pages/forges-refused.ts, src/web/pages/forges.ts, test/forges-refused.test.ts try 2: no files changed try 3: no files changed

Split by the planner: the page itself is #11586 (route, page, test, no change to /forges); the one-line link from /forges and the docs are #11587, behind it. Both earlier pulls touched the route table, /forges and a new feature doc at once; each half now names the route lists and docs index it must satisfy.