A signed-out visitor sees Make it yours on every public app in /explore, and it carries them through sign-in to the plan of their copy #7748

For: the P2 Friend test — someone the owner sends an app to makes it theirs in one action. Today copyable in src/actions/explore.ts is false whenever there is no viewer, so a friend who is not signed in sees each app row on /explore with no Make it yours button, even for public apps. The page it would link to, /:owner/:name/make-it-yours, already sends a signed-out person to sign in (signInFirst) and brings them back with next.

Done looks like:

• [ ] Signed out, every row for a public app on /explore shows Make it yours, linking to /:owner/:name/make-it-yours. Private apps never show it to a signed-out visitor, and nothing about them leaks.
• [ ] Signed in, nothing changes: no button on your own apps, none for agents or inactive accounts, and the existing private-app rule stays (canEnterApp … named:false).
• [ ] Following that link signed out ends on sign-in with next=/:owner/:name/make-it-yours, and after sign-in lands on the plan of the copy (with an edge in front, the edge login carries the same next).
• [ ] Tests in the explore action and page suites fail without the change: signed-out public row is copyable, signed-out private row is not, and the button's href is the make-it-yours path.
• [ ] A look at /explore signed out on the preview shows the button on a public app row.

Files: src/actions/explore.ts, src/web/studio/explore.ts, their tests. Risks: the copyable rule is also shown to signed-in viewers, so keep each viewer kind's case in a test. Do not add a POST that works without a session: the copy is still made only after sign-in. Suggested builder: a web/studio builder.