`forge new <name> "what it is"` makes an app from your shell, clones it into your forge folder and prints its address, as POST /api/v1/apps does #7380

Intent: building a new thing starts with one line in a terminal: the app exists, it is on disk, and the crew can be told what to do.

Done:

• [ ] forge new <name> [description…] calls POST /api/v1/apps through a new newApp method in src/cli/api.ts with name, description, and --private as visibility: "private" (public otherwise), --owner org as owner.
• [ ] On success it clones the new repository into the same root forge sync uses (reuse its clone path from src/cli/sync.ts), prints the app's page and, when the answer has one, its live address, and exits 0.
• [ ] A refusal (name taken, invalid name, repository, storage or app limit) prints the API's own words and exits with the matching code from EXIT; nothing is cloned. An empty name prints usage and exits 2. forge help lists the command.
• [ ] A test (e.g. test/cli-new.test.ts) against a fake API checks the request body, that --private is sent, the printed address, and that a 403 or 422 prints the API's words and clones nothing.

Files: src/cli/main.ts, src/cli/api.ts, a new test.

Risk: the name goes to git clone as an argument from the API's answer, never through a shell; use the answer's clone URL, not one built from the typed name.