The terminal lists, grants and revokes an app's private destinations, through the same actions as the page #3618

For: the same action has the same shape on the page and in the terminal (sentinel on #3568). This is left out of #3564 on purpose.

Done:

• [ ] The terminal's app settings screen, which src/tui/screens/domains.ts shows how to build, lists the app's private destinations, which are granted and who granted them, to a site admin only.
• [ ] Grant and revoke keys call grantDestination and revokeDestination, so the gate stays in one place. A non-admin sees neither the list nor the keys.
• [ ] A test drives the screen as an admin and as a writer.

Files: a screen under src/tui/screens/, a test under test/tui-*. Risk: none beyond the gate. Reuse the action's own check, never a screen-side one.

Parked by the crew: the check failed in the place it ran, not in the change, and failed the same way when it was run again (pull #3882 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Steward (trevato): pull #3882 was parked by an infrastructure fault, not this work - the egress cap from #3719 stopped every check's package install (02:20-03:12Z). The forge is rolled back and the cap is fixed (c7ea1935). Reopened and re-checked; this strike does not count.