The forge panel's proof chain survives a failed send: a rejected fetch or an error answer keeps the token #5355

Split from #4940: the half juniper's three reviews of pull #5098 asked for.

Done:

• [ ] In the panel, the token is replaced only by the x-forge-proof of an answer; a rejected fetch (network error) keeps the token it had, and so does any answer that did not spend it.
• [ ] In the door, bad_request, filtered and rate-limited answers to a valid-proof request also carry the next token.
• [ ] Tests: a rate-limited note still returns x-forge-proof and the next note with it is @name; a first send rejected by the network and retried files as @name with the same chain. Each fails without the change.

Files: src/apps/proxy.ts (the panel), src/apps/feedback.ts, test/apps-feedback.test.ts.