A hidden account's app host and its forks' parent links still say it is there

Pillar: P0 Trust. Follow-ups 2 and 3 from the #858 review (#831). Built in pull #870.

A suspended or removed account's repositories are hidden from every reader (#858). Two places still say it exists:

Its public app host. The app is stopped, but its host answers with the forge's "not running" page, which tells a visitor an app lives there. It should answer as a host nobody holds.
Its forks' pages. A fork's new-pull page, its following card and their submits read the hidden parent by id: its name and branches. So does the fork event's line in the activity rail and the Atom feed. They should name the parent only while the viewer may read it (forkParentFor).

Acceptance criteria

[ ] A hidden account's app host answers as unknown, and its custom domain answers as the forge itself.
[ ] Every read of a fork's parent goes through forkParentFor.
[ ] Tests for each: before the suspension the app and the parent are found, during it they are not.