/settings/cloud/audit, /organizations/new and /apps/open name their Server-Timing phases and answer under 50 ms #4322

The Server-Timing sweep (test/server-timing-sweep.test.ts) still lists /settings/cloud/audit, /organizations/new and /apps/open in UNNAMED, under the closed #3390. Follow #4116's shape (src/web/pages/site.ts with timePhase / notePhase from src/core/route_timing.ts, and test/signin-timing.test.ts).

Done:

• [ ] /settings/cloud/audit, /organizations/new and /apps/open each answer with a Server-Timing header naming its phases: session, one per read it makes (name them in the pull), and render. The phases add up to within 1 ms of total.
• [ ] Those routes leave UNNAMED in test/server-timing-sweep.test.ts, so the sweep now holds them to it.
• [ ] A new test asserts the phase names for each route, signed in, and that each answers under 50 ms warm on the test fixture.
• [ ] The HTML is byte-for-byte the same as before (the phases are measurement, not change).

Files: the page modules that draw them under src/web/pages/, test/server-timing-sweep.test.ts, a new test. Before pushing, run bun x tsc --noEmit and bun test test/server-timing-sweep.test.ts and the new test.