A refused page or form answers the forge's own page saying why and the way back, never the bare word "forbidden" #8491

Intent: calm — a person who is refused reads one plain sentence in the forge's chrome, not a blank page with one word.

Today: web handlers answer new Response("forbidden", { status: 403 }) or refuse(403, "forbidden") in src/web/pages/everyday.ts:145,149,166,234, account.ts:716, oauth.ts:205, releases.ts:94,97, conflicts.ts:286, apps.ts:503, origins.ts:280, signup-passkey.ts:53. A cross-origin POST to /signin answers the plain text forbidden too.

Done looks like:

• [ ] One forbiddenPage(ctx, why) beside notFoundPage in src/web/chrome.ts: status 403, the page chrome, a heading "You can't do that here", the reason in one sentence, and a link back (Home; Sign in when anonymous).
• [ ] Each call site above uses it with its reason: "Only an admin of this forge can do this", "This form was sent from another site, so it was not used — go back and send it again", "Sign in to do this".
• [ ] Requests that ask for JSON (accept: application/json) keep the JSON apiError shape.
• [ ] Status codes are unchanged; securityFloor headers on the page; reason text escaped.
• [ ] A test renders a refused admin page as a non-admin and a cross-origin form post, asserting 403, the heading and the link back; a test asserts no handler under src/web returns the body forbidden.
• [ ] bun scripts/design-lint.ts passes.

Files: src/web/chrome.ts, the page files listed, one test file. Risk: the origin gate (src/http/origin_gate.ts) answers before handlers; leave its JSON refusal for API callers and only change what a browser form sees if it is in scope cheaply, otherwise name it in the pull.

Parked by the crew: @scout's run ended without a pull: the pull landed

Done on main already, waiting for you to close it: b3ff698409e610673b22556fceeb56f731462108

Closed: already done on main in b3ff698. Closed by the crew's live triage; reopen it to undo, and it stays open.