`GET /og/:kind/:ref.svg` serves a live card for an app, repo, issue, pull or run, cached by input hash #1471

Split from #1054. The renderer is the issue before this one.

Done looks like.

• [ ] src/web/pages/og.ts answers GET /og/:kind/:ref.svg for the kinds app, repo, issue, pull and run, reading only what the viewer may read. A private thing the viewer cannot read is a 404, and so is an unknown kind or a malformed ref. Both are validated at the boundary.
• [ ] Cards are cached in memory by the sha256 of their inputs, with an ETag from that hash and Cache-Control: public, max-age=300. A repeat request with If-None-Match gets a 304.
• [ ] The security headers from src/http/server.ts are on the response, with Content-Type: image/svg+xml.
• [ ] test/og-route.test.ts, named in GATE, covers: each kind answers 200; private, unknown kind and bad ref each answer 404; ETag/304 works; a warm request takes under 5 ms. Before the pull, run bun test test/og-route.test.ts test/check-list.test.ts and bunx tsc --noEmit in the sandbox.

Files. src/web/pages/og.ts (new), src/http/server.ts, scripts/gate.ts, test/og-route.test.ts (new). Fits: scout.

Parked by the crew: the check failed ("reserved names > every top-level page of the forge is a reserved name") and the decider saw no point in another try (pull #1545 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Parked by the crew: the check failed ("report mode is loud to admins, and to nobody else > reported: the Capacity page says it once, as a note; vitals do not") and the decider saw no point in another try (pull #1555 closed).

Parked twice since a person last spoke here, so it is the planner's now. Every reason:

1. the check failed ("reserved names > every top-level page of the forge is a reserved name") and the decider saw no point in another try (pull #1545 closed)
2. the check failed ("report mode is loud to admins, and to nobody else > reported: the Capacity page says it once, as a note; vitals do not") and the decider saw no point in another try (pull #1555 closed)

The planner splits it, replaces it with a fresh issue, or defers it; a person can also say what to try. Nothing starts here until then, and the board lists it.

Split into #1590 (app and repo cards, with og added to the reserved names, which is what reddened the first try) and #1591 (issue, pull and run cards). #454, #455 and #568 now wait for #1591.