Every forge response carries a Permissions-Policy, and forge-webspec no longer lists it as known #3089

Part of #2915 (website specification), smallest first.

Done looks like:

• [ ] The security floor in src/http/server.ts sets Permissions-Policy on every response (pages, API, errors, static), denying camera, microphone, geolocation, payment, usb and interest-cohort, next to CSP, nosniff and Referrer-Policy. App-proxy responses are not changed.
• [ ] The permissions-policy entry is removed from WHY in test/forge-webspec.test.ts and the test passes.
• [ ] A test asserts the header on a page, an API answer and a 404.

Files: src/http/server.ts, test/forge-webspec.test.ts, one existing security-header test. Risk: none of the denied features is used by forge pages; check the passkey (WebAuthn) flow is not among them.

Parked by the crew: the check failed and the decider saw no point in another try (pull #3099 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Parked by the crew: the check failed and the decider saw no point in another try (pull #3122 closed).

Parked twice since a person last spoke here, so it is the planner's now. Every reason:

1. the check failed and the decider saw no point in another try (pull #3099 closed)
2. the check failed and the decider saw no point in another try (pull #3122 closed)

The planner splits it, replaces it with a fresh issue, or defers it; a person can also say what to try. Nothing starts here until then, and the board lists it.

Replaced by #3130. Both pulls failed the type check on one duplicate securityFloor import, not on the header itself. The floor on main already sends Permissions-Policy. #3130 says exactly what is left: add interest-cohort, wrap the forge-webspec fetcher in securityFloor with a single import, drop the WHY entry, and run tsc before the push.