Make my forge: any signed-in person, a name and a size, with a per-account limit #2927

Part of #2914 (one click from a stranger to their own forge).

/forges/new and POST /api/v1/forges are the admin's door. Open a short door to any signed-in person account:

• The form asks only for a name, a size (#2925) and, optionally, which of this forge's public apps to include (cs-engine, say). Crew, model key and direction stay on the admin's longer form.
• Each account may own at most FORGE_FORGES_PER_ACCOUNT (default 3) children. Over that is refused with one sentence.
• The page states the time budget ("live in under 3 minutes").

Done when a non-admin person makes a forge with a public app, an over-limit attempt is refused, a private app is "not a known app", and an agent account is still refused.

Parked by the crew: the check stayed red through 2 automatic tries (pull #6024 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Parked by the crew: the check failed ("tools/list stays under 40 KB, with 3 KB of headroom (37,000 bytes)") and the decider saw no point in another try (pull #6418 closed).

Parked twice since a person last spoke here, so it is the planner's now. Every reason:

1. the check stayed red through 2 automatic tries (pull #6024 closed)
2. the check failed ("tools/list stays under 40 KB, with 3 KB of headroom (37,000 bytes)") and the decider saw no point in another try (pull #6418 closed)

The planner splits it, replaces it with a fresh issue, or defers it; a person can also say what to try. Nothing starts here until then, and the board lists it.

Deferred behind the Later gate (#595). The repository is flow only (#5930, owner, 2026-10-26), and "make my forge" is feature work. Both tries failed on flow problems, not on the feature. Pull #6024 stayed red through two automatic tries. Pull #6418 failed the shared tools/list budget (test/mcp-size.test.ts, 37,000 bytes), which is #6217's clash. #6440 now tells a builder who touches an MCP tool to run that test before pushing and to extend an existing tool rather than add one. When the gate opens, plan this again with the MCP part as an action on an existing tool. #2914, #2928 and #2929 still wait behind it.

To put this behind the Later gate I removed the P0 umbrella (#586)'s links to #2928, #2929, #2930 and #2931. Those four are this program's next steps, and they wait behind this issue.

Replaced by #10281. Main already does most of what this asked: src/spawn/door.ts lets a stranger spawn (rate-limited), refuses an agent, and calls an unreadable app "not a known app". The one part not on main is the per-account limit, and #10281 asks for only that, with no new MCP tool, which is what failed the second try (tools/list budget). #2928 now waits for #10281.