A site admin grants an app's private destinations on its settings page, and only the repository's admins hear about it #3621

For: replaces #3564, a person's ask. Pull #3568 built it, and three review rounds left one high finding open. The work is on branch scout/3564-grant-and-revoke-private-destinations-on at d954f722: start from there, not from scratch.

Done (#3564's ask, plus what the reviews found):

• [ ] The app settings page lists 'Private destinations': every private egress entry in forge.json, with Grant and Revoke for a site admin, and 'waiting for a site admin' for anyone else. Each shows who granted it and when. A grant takes effect without a manual redeploy, and the page says how.
• [ ] *app.egress_ events are admins in src/core/event_audience.ts*, as app.env_ and app.domain.* are. A guest-vs-admin audienceFilter test finds the private address:port and the granter absent for a guest.
• [ ] The rows use row({ lead, title, meta, trail }) from src/web/ui.ts in a <ul class="list setting-list">, with the form in .row-fields. Grant is an outline button, so Save stays the page's one accent.
• [ ] Tests:

- eventVerb for granted, revoked, and a payload with no destination; - cellFor (or the CellSpec that startProcess builds) carries a granted destination; - ungranted → button, grant → listed, revoke → refused again.

Files: what the branch already touches, plus src/core/event_audience.ts. Not this issue: the terminal (#3618) or the coverage test for every event kind (#3612).

Parked by the crew: the check stayed red through 2 automatic tries (pull #3625 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Replaced by #3825. Most of this is on main already: #3534 and #3543 added grant and revoke on the app settings page, the API and the terminal. app.egress.* events are already admins in event_audience.ts, and src/design/activity.ts words them. What is left is how the rows are built: row() in a setting-list, with an outline Grant. #3825 is only that, one file and its test. #3618 now waits on #3825.