A note from the app's own origin is a visitor's unless it carries the forge panel's one-use proof #5612

Replaces #5395, the same done started fresh from main. Both tries went red on the merge-queue deadline test, which this change never touches; this waits for its fix (and #5394, the mirror-stages flake that sank #5354).

Done:

• [ ] When the forge serves a signed-in person's page load (Sec-Fetch-Dest document, absent, or a cross-site iframe), the injected panel's script tag carries a one-use token bound to the grant cookie and the host. The panel strips it on load. A proofed page answers cache-control: private, no-store.
• [ ] POST /__forge/note and GET /__forge/notes (src/apps/feedback.ts) spend the token. With a valid one, the note is @name and the list is theirs. Without a token, or with a reused one or one for another grant or host, the note is visitor-…, the list is the visitor's, and admin is false.
• [ ] Every answer to a request with a valid proof carries the next token in x-forge-proof.
• [ ] test/apps-feedback.test.ts covers five cases: unproven is a visitor; proven is @name; reused, foreign-grant and foreign-host tokens are visitors; and a same-origin fetch of the page gets no token. Each fails without the change.
• [ ] Before pushing, run test/apps-feedback.test.ts, test/toolbar-actions.test.ts, test/apps-crew-pill.test.ts and bun x tsc --noEmit. A red test elsewhere that main also has is named in the pull, not a reason to stop.

Files: src/apps/feedback.ts, src/apps/proxy.ts (the panel), test/apps-feedback.test.ts. Risk: the panel script stays under the CSP nonce. Never put the token in a URL.