An app host's /__forge/ door escapes every name it draws and answers a private app's stranger with the same 404 as an unknown app #5908

The way back from any app must not leak or inject. The door (src/apps/door.ts) draws the app's, repository's and pull's names.

Done when:

• [ ] A test seeds an app, a repository and a pull whose names contain <script> and quotes, and finds every one escaped on /__forge/ for production and for a preview.
• [ ] For a private app, a signed-out visitor and a signed-in stranger get the exact status and body an unknown app host gets. Nothing in the answer names the app.
• [ ] Any leak found is fixed in the same pull.