The flow panel on /boards lists held files, with a form to hold one and a Release button on each #6525

Part of #5930, section 3.

Done:

• [ ] For a repository admin, the flow panel lists held paths with who held them and when, a Release button on each, and a one-field form to hold a path; both are same-origin POSTs.
• [ ] Non-admins see the list without the controls.
• [ ] Tests: hold, list, release, a non-admin's refusal.

Files: src/web/pages/flow-panel.ts, the boards route, a test.

Before pushing: bun scripts/design-lint.ts and the tests you touch.

Replaced by #6846. Parked twice: the reviews kept finding that the card hides the hold form from a repository admin who isn't a forge admin and has no hold yet. #6846 states that as done, and waits for the /boards incident #6840 because it touches the same panel.