A test pins `readReturns`' refusals: a bad window, no viewer, and a repository the viewer may not read are refused the same way a missing one is #6761

src/actions/returns.ts says what the tokens bought, to owner-fact holders only; no test calls readReturns directly.

Done when a new test file, on a seeded app with two repositories (one the viewer owns, one a stranger's), proves:

• [ ] no viewer is unauthorized.
• [ ] days of 0, 91, 1.5 and NaN are bad_days; 1 and RETURNS_DAYS.max are accepted; omitted means RETURNS_DAYS.default.
• [ ] repo naming the stranger's repository, a missing one, a/b/c and a/ are each not_found, indistinguishable from each other.
• [ ] with no repo, repos lists only the viewer's repository; the window ends at the now passed in.

Test only; a bug it finds is fixed in the same pull.