Opening an app's environment through the API names its Server-Timing phases: session, repo, open #5361

For: GET /api/v1/repos/{owner}/{name}/app/{env}/open (src/http/api.ts, near line 6008) is the one remaining untimed JSON read under /api/v1 that is not a stream and has no open issue. A client's "open my app" tap that feels slow should say which side is slow.

Done:

• [ ] The handler marks session (notePhase(ctx.request, "session", takeSessionTime(ctx.request))), repo (loadRepo) and open (openEnvUrl) with timePhase, as GET /api/v1/returns just below it does.
• [ ] A new test/api-app-open-timing.test.ts, shaped like test/api-runs-timing.test.ts, asserts all three names appear in server-timing for a writer opening production, and fails without the change.
• [ ] The answer ({ url }, or the 422 refusal) is unchanged.

Files: src/http/api.ts (this handler only), test/api-app-open-timing.test.ts. Risk: #5316 and #3782 edit run handlers nearby; touch only this one.