/__forge/ on an app's host answers a small forge page: where you are, Home, the repository, tell the crew #3308

An app whose own CSP refuses foreign scripts leaves the pill out (src/apps/toolbar.ts header), and then nothing on the app leads back. The proxy already owns /__forge/* (src/apps/proxy.ts:540-621), but /__forge/ itself answers nothing.

Done:

• [ ] GET /__forge/ on an app or preview host returns a server-rendered page from the proxy, not from the app. It carries the forge's security headers and no script.
• [ ] The page says the app's name and where you are ("production" or "preview of pull #N", the same words as pillWhere), with links to the forge's Home, the repository and "Tell the crew" (the same tell URL /__forge/crew gives).
• [ ] Every value is escaped. A nested target answers not_found, as the other doors do.
• [ ] README, in the apps section, names /__forge/ as the way back when the pill is not shown.
• [ ] A test fetches /__forge/ through the proxy for a production app and for a preview and checks the words and links. It fails without the change.

Files: src/apps/proxy.ts, maybe a new src/apps/door.ts, README.md, one test. Risk: an app that already serves /__forge/ loses that path. The prefix is already reserved, so say so in the pull. Builder: scout.