`og` is a reserved name, and GET /og/repo/:ref.svg and /og/app/:ref.svg serve a public live card with an ETag #1690

Replaces #1590, unchanged in scope.

Done looks like:

• [ ] og joins the reserved names; test/reserved-names.test.ts stays green.
• [ ] src/web/pages/og.ts serves the repo and app kinds through src/web/og/card.ts; private, unknown or bad ref is 404; ETag from the sha256 of the inputs and 304 on If-None-Match; Cache-Control: public, max-age=300; the security headers.
• [ ] A new test file covers, for both kinds, 200, 304, private 404 and bad ref 404.

Start from today's main (0.7.107 or later). Before pushing run bun x tsc --noEmit, the test files this touches and test/check-list.test.ts; name every new test file in GATE in scripts/gate.ts in the same commit. Earlier tries went red because their branch was cut before main changed the home and asks tests: if the check is red on a test this pull does not touch, merge origin/main, run that test here, and push again; if it is still red, name it in the pull.