The forge's own signed-out pages go through webspec() in a test, with today's findings named #3043

Part of #2915. Today webspec() runs only against fixtures (test/webspec.test.ts, test/webspec-site.test.ts) and previews, never against the forge itself.

Done looks like:

• [ ] test/forge-webspec.test.ts builds a forge as the other tests do and runs webspec("http://forge.test", ["/", "/signin", "/signup", "/explore"], fetcher, { site: true }). Here fetcher hands each request to forgeHttp(app).handle (no socket). Use whichever of those paths exist; the pull lists them.
• [ ] The findings' check names are held to a KNOWN list in the test, each with its section and one line on why it stands (for example "HSTS: set at the edge"). A new finding fails the test.
• [ ] The pull lists today's findings as candidates for follow-up issues. Fixing them is out of scope.

Files: test/forge-webspec.test.ts. Risk: none to runtime; keep the test under 2 s.