Spawning a pod child through the API and MCP is for a site admin only, and refused anonymously #3786

Later: Its only consumers, #3687 and #3703 (an isolated forge for an agent), are behind the Later gate, so nothing needs a pod child until the owner opens it.

Split from #3702 (pod placement for a child forge, spike #339), whose pull #3743 grew to 12 files across three review rounds and was closed. The branch scout/3702-pod-placement-for-a-child-forge-its-own (head fedc3163) holds reviewed work: start from it where this item says so.

Done:

• [ ] POST /api/v1/forges and the MCP spawn tool take placement: "hosted" | "pod" and limits.
• [ ] Both are refused for an anonymous caller, and pod is allowed only for a site admin (sentinel, High).
• [ ] A pod child goes through src/spawn/pod_host.ts, which exists only when FORGE_POD_IMAGE is set; without it the request is refused in plain words. The ledger records the limits. A failed placement deletes only a namespace this call created.
• [ ] test/spawn-pod-door.test.ts covers four cases: an anonymous caller refused, a non-admin refused, an admin placed, and a hosted child with limits refused.

Files: src/actions/spawn.ts, src/spawn/plan.ts, src/spawn/door.ts, src/spawn/pod_host.ts, src/http/mcp.ts, test/spawn-pod-door.test.ts.