/settings/crew shows issues the crew parked twice and the last restore drill, each card only when it has something #3879

Replaces #3819. Pull #3822 built the crew page's two cards and three reviews found the shape right; what was left is below. Start from its branch, scout/3819-crew-feed-show-issues-the-crew-parked-tw (head c3a08cdf), rebased on today's main, not from scratch.

Taking these notes off the owner's board is not this issue: that is #3846. Do not touch src/web/pages/board.ts or the terminal board here.

Done:

• [ ] /settings/crew, for a forge admin only, shows a "Handed to the planner" card: one row per issue the crew parked twice (repo, issue link, title, when last parked, each park reason cut to one line), read from parkedTwice() in src/crew/parks.ts; an issue leaves it when it is split, replaced or deferred.
• [ ] The same page shows a "Restore drill" card: the last drill's pass or fail and when.
• [ ] With no parked-twice issue the first card is not drawn at all; with no drill the second is not drawn and the data-drill="none" copy is gone (an empty card is a zero drawn, docs/DESIGN.md).
• [ ] Both cards use the design system's card head like the other crew cards, not a hand-rolled <h2 class="mb">.
• [ ] The terminal's crew screen shows the same two sections from the same module, under the same rules.
• [ ] Reason text is escaped. A test covers: admin sees both, a non-admin gets neither, empty hides each card, an HTML-bearing reason is escaped.

Files: the crew settings page, the terminal's crew screen, src/crew/parks.ts (read only), the new test, listed in scripts/gate.ts if the gate still lists files. Risk: the drill's record lives elsewhere than the branch assumed after a rebase; read it where /settings/backups reads it.

Parked by the crew: the check failed in the place it ran, not in the change, and failed the same way when it was run again (pull #3909 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Steward (trevato): pull #3909 was parked by an infrastructure fault, not this work - the egress cap from #3719 stopped every check's package install (02:20-03:12Z). The forge is rolled back and the cap is fixed (c7ea1935). Reopened and re-checked; this strike does not count.