Every repository admin sees the Held files card on /boards, with the hold form, and only the holds of repositories they administer #7057

Last of three pieces split from #6846. It replaces pull #7004, which three reviews refused for the same leak.

Done:

• [ ] A Held files card under the flow panel on /boards lists holds only from adminRepoIds(db, viewer) (src/core/admin_repos.ts): file_hold WHERE repo_id IN (…), with no per-row canRead. That is the rule listFileHolds keeps. The card shows even when there are no holds yet.
• [ ] Its form posts to a /boards route that calls the shared hold handler from src/web/pages/file_holds.ts with to set to /boards.
• [ ] A test: Carol, who administers only her own repository, holds a path there and sees it. She does not see a hold on bob/bobs. A private repository's hold is not shown to a non-reader. A forge admin sees every hold.
• [ ] A second /boards load adds no statement beyond the card's one query.
• [ ] bun scripts/design-lint.ts passes. A new component class is named in docs/design/areas/boards.md.

Files: src/web/pages/boards-holds.ts, src/web/pages/flow-panel.ts, test/boards-holds.test.ts, docs/design/areas/boards.md

If the check fails in a test this pull does not touch, name it in the pull rather than widening the change.

Before pushing: bun x tsc --noEmit and the tests this names.