/settings/people says what a guest cannot do, instead of "nothing is refused because of one yet" #7200

For: the owner is told plainly what a role means. Trust means being plain about who can do what.

Today /settings/people (src/web/pages/people.ts:66-69, and the comment at line 5) says "Roles are recorded here; nothing is refused because of one yet." That is false. docs/ROLES.md (parts 2 and 3a) says a guest cannot create or fork a repository, or make an app their own, or start a crew run. Only an admin may change the forge's settings or releases.

Done:

• [ ] The line under "Guests, members and admins" says in two short sentences what a guest cannot do and what only an admin can do. The words come from the same source that writes the refusals or the roles table (src/core/roles.ts), so they cannot drift again.
• [ ] The stale module comment is corrected.
• [ ] A test fetches /settings/people as an admin and asserts the new sentence, and that "nothing is refused" is absent.
• [ ] bun scripts/design-lint.ts passes.

Files: src/web/pages/people.ts, perhaps src/core/roles.ts, one new test file. Risk: low.