A milestone's limb links encode `under`, and a test pins `milestoneHref` and `limbHref` #6659

limbHref in src/web/pages/milestones.ts pastes under into a query string unencoded; a seat value with & or # would cut the link.

Done:

• [ ] limbHref passes under through encodeURIComponent; the action is one of the fixed words and stays as is
• [ ] A new test asserts milestoneHref("/a/b", 7) is /a/b/milestones/7, limbHref with and without under, and that under = x&y round-trips through URLSearchParams
• [ ] No other file changes

Files: src/web/pages/milestones.ts, test/milestones-href.test.ts

Risks: the limb page reads under with URLSearchParams already, so encoding changes nothing for today's values.

Before pushing: bun x tsc --noEmit, bun test test/milestones-href.test.ts, and bun scripts/design-lint.ts.