A test pins where a tell says it was said: a `from` that is not this forge's page or app address is refused #7092

tell in src/actions/tell.ts refuses with bad_from, and no test names any of them. It guards the from a tell records.

Done:

• [ ] A new test tells with from set to a page URL on this forge, and the tell keeps it.
• [ ] A from on another host, a javascript: URL, or one carrying a control character is bad_from, and no tell is stored.
• [ ] An app's own address is accepted only when the tell comes from that app.

Files: test/tell-from.test.ts

If the test finds the behaviour wrong, fix the action in the same pull and say so. If the check fails in a test this pull does not touch, name it in the pull rather than widening the change.

Before pushing: bun x tsc --noEmit and the new test.