A private app can name the people who may enter it, beyond writers and the crew #752

Pillar: P0 Trust. Follow-up to #620 (a private app on a public repository stays private).

After #620 a private app admits people who can write the repository, and its crew. The owner may want to let in someone who cannot write (a client, a tester).

• [ ] a per-app member list (needs a migration: ask for a number), edited by people who can write the repository; page, API and MCP path
• [ ] canEnterApp reads it; previews follow their app
• [ ] refusing tests: a named member enters and a reader who is not named does not; removing a name ends a grant already issued
• [ ] the app's Access hint says who is named