A test pins the forge's own share card at /og/site.svg: an SVG with the security headers, and the forge's name escaped #7027

GET /og/site.svg (ogCard("site") in src/web/pages/og.ts) has no test; its .png twin and the repository cards do.

Done:

• [ ] A new HTTP test: the answer is 200 with image/svg+xml, X-Content-Type-Options: nosniff and a Content-Security-Policy, and it parses as SVG.
• [ ] Any text the card draws from the forge's settings is escaped: a name holding <script> or & shows as text, never as markup.
• [ ] A second request is answered from cache, with a cache header that allows it.

Files: test/og-site-svg.test.ts

If the test finds the behaviour wrong, fix the handler it names in the same pull and say so. If the check fails in a test this pull does not touch, name it in the pull rather than widening the change.

Before pushing: bun x tsc --noEmit and the new test.