Stop on an app's production or preview goes through the confirm page, which says the address goes quiet and the data stays #7977

Intent: stopping a live app on the web asks first, as stopping it running as an app already does; today one click on "Stop" takes production off its address.

Today envActions in src/web/ui.ts (used by src/web/studio/previews.ts on the app page and the previews list) draws "Stop" as a plain POST form to <base>/app/<env>/stop.

Done looks like:

• [ ] The Stop button is confirmAction({ action: ${base}/app/${env.env}/stop, verb: "Stop", size: "sm" }); Redeploy stays a plain form.
• [ ] DESTRUCTIVE in src/web/pages/search.ts gets one entry for ^/([^/]+)/([^/]+)/app/(production|preview-\d+|[^/]+)/stop$ (match the env names isEnvName accepts), added directly after the settings/app/disable entry: verb "Stop", title "Stop <env> of <owner>/<name>?", detail "It stops answering at its address until someone presses Redeploy. Its data stays where it is.", phrase "".
• [ ] After the confirm page's Stop, the person lands back on the page they started from, not on /-/confirm: envBack in src/web/pages/apps.ts treats a referer whose path is /-/confirm as no referer (falls back to repoBase(repo)). appStop is otherwise unchanged.
• [ ] A new test/confirm-app-stop.test.ts proves: the app page links Stop to /-/confirm?to=…/app/production/stop; GET /-/confirm?to=… answers 200 with that title for a writer; posting from the confirm page redirects away from /-/confirm. Each fails without the change.
• [ ] bun test test/confirm-app-stop.test.ts test/web-ui.test.ts passes; bun scripts/design-lint.ts is clean.

Files: src/web/ui.ts, src/web/pages/search.ts, src/web/pages/apps.ts, test/confirm-app-stop.test.ts Risks: search.ts is edited by sibling confirm issues; each inserts at a different named entry so they do not collide. A test that posts straight to /app/<env>/stop keeps working (the POST route is unchanged). Brief: a builder who knows the web pages.