Private pages work with the platform edge turned off: the forge alone issues and checks every session #1460

Part of #666, the owner's ask. Pull #781 tried all of #666 at once and stayed red. This part is the one that makes the forge's identity its own.

Done looks like

• [ ] A private page (a private repository, the admin's settings) is reached through the forge's own session cookie (HttpOnly, SameSite, Secure in production) with no edge header configured. A forge-specific header from the edge is never what grants access.
• [ ] A test boots the forge with no edge configured, signs in, and reads a private page. Without the session it gets a sign-in page, not the content.
• [ ] A session or token revoked by its owner, or by the forge owner (#750 built the page), is refused on the very next request. A test proves it.
• [ ] Every new test/*.test.ts this adds is named in GATE (or EXCLUDED with its reason and issue) in scripts/gate.ts in the same commit, and bun test test/check-list.test.ts passes before the push.
• [ ] Before pushing, run bun x tsc --noEmit and the test files this touches (the sandbox sets FORGE_TEST_SOCKET, so the server suites run there), and quote both results in the pull.

Files: src/http session middleware, src/actions/users.ts, one new test file. Risk: production sign-in. Keep the edge path working until this lands, and say in the pull how a live session carries over. #667 (passkeys) waits for this. Builder: sentinel.