One test walks a stranger from sign-up to a planned forge through the API alone, naming the step that broke #3096

From #2914 step 6 (rock solid) and step 5 (an agent can do it unattended).

Done looks like:

• [ ] test/stranger-to-forge.test.ts, against forgeHttp(app).handle with no socket: an anonymous caller signs up with username and password (no email), signs in, gets a token, and makes a dry-run POST /api/v1/forges; the plan answers 200 with the new owner named as first admin.
• [ ] Each step runs under its own name, so a failure says which step broke (sign-up, sign-in, token, plan).
• [ ] The test runs in under 2 s and needs no network.

Files: test/stranger-to-forge.test.ts only, unless a step proves impossible through the API; then the pull names the gap and fixes the smallest route that closes it.