A test pins an app's custom domains in Settings: add, check, delete, a repository admin's only #7023

POST /:owner/:name/settings/app/domains, …/domains/:host/check and …/domains/:host/delete (appDomainAdd, appDomainCheck and appDomainDelete in src/web/pages/settings.ts) have no test.

Done:

• [ ] Each case posts the form the way the page does, through readForm, with the session cookie and a same-origin Origin header. A repository admin adds shop.example.com, and the flash names the records to publish. Check without the proof published says it is not there yet. Delete removes it.
• [ ] A host that is not a hostname (a b, http://x, an IP, the forge's own host) is refused with the page's words, and nothing is added.
• [ ] A writer who is not an admin gets the refusal. Someone who cannot read the repository gets "not found".

Files: test/settings-app-domains.test.ts

If the test finds the behaviour wrong, fix the handler it names in the same pull and say so. If the check fails in a test this pull does not touch, name it in the pull rather than widening the change.

Before pushing: bun x tsc --noEmit and the new test.