A site admin grants or revokes an app's private destinations on its settings page and through the API #3433

Split from #3369; the grants exist after the issue this waits on.

Done:

• [ ] The app's settings page lists "Private destinations asked for" from its forge.json, each with Grant or Revoke for a site admin only; others see the list and who granted each, with no buttons.
• [ ] POST/DELETE routes under /api/v1/repos/{owner}/{name}/egress-grants do the same, admin only, same-origin checked, input validated (exact address:port that forge.json names).
• [ ] Grant and revoke are recorded with who and when and show on the page.
• [ ] A test covers: a non-admin is refused, an admin grants and the list shows it, revoke removes it, a destination not in forge.json is refused.

Files: src/web/pages/settings.ts (or the app settings module), src/http/api.ts, one action module, one test. Do not touch src/tui/.