An app host's /__forge/ door and /__forge/crew name their Server-Timing phases: session, each read, render #5857

These are the way back to the forge from any app (src/apps/door.ts, src/apps/proxy.ts). Every forge page names its phases; these two do not.

Done when:

• [ ] GET /__forge/ and GET /__forge/crew on an app host answer with Server-Timing naming session, each read they make (app, pull, working), and render. They use notePhase and timePhase from src/core/route_timing.ts, the way src/web/pages/milestones.ts does.
• [ ] A test requests both on a production host and on a preview host. It finds each named phase, and finds no phase over 20 ms warm.
• [ ] Answers are otherwise unchanged. The existing door tests pass untouched.