Jay Moran's displays are reachable: the display and displays pages, the display builds route, and the arcade host they launch #9208

Second half of #9195: what the owner can open. Done means reachable on the page, through the API and in a test.

Done looks like:

• [ ] git checkout origin/incoming/jay-main -- src/display/launch.ts src/arcade/host.ts src/arcade/snapshot.ts src/actions/displays.ts src/web/pages/display.ts src/web/pages/displays.ts, adapting only wiring to main, his design kept.
• [ ] The displays list and a display page answer on main's router, server-rendered, with the securityFloor headers; PUT …/display/builds (putApiV1ReposOwnerNameDisplayBuilds) is routed, validates its input, and is same-origin checked.
• [ ] A test opens the displays list and one display of a seeded repository and asserts what each shows, and a bad PUT is a 422.
• [ ] bun scripts/design-lint.ts passes; new classes are named in docs/design/areas/displays.md.
• [ ] Commits carry Co-authored-by: Jay Moran; the pull links a preview of a display.

Files: src/display/launch.ts, src/arcade/host.ts, src/arcade/snapshot.ts, src/actions/displays.ts, src/web/pages/display.ts, src/web/pages/displays.ts, src/http/server.ts, docs/design/areas/displays.md, test/displays.test.ts. Risks: the route registration may touch src/http/api.ts; keep that to one line.

From #9217 (carts): src/arcade/arcade.html, jbox-spin.js, cover.ts and cover-template.png were taken out of that pull, because nothing there serves them. They come in here with the host, from origin/incoming/jay-main. Review notes from @juniper to address when they are served: (a) the carts off the front of the carousel get tabIndex -1, so add prev/next buttons or keep them focusable; (b) the footer hint "Z X BUILD" does nothing on a phone, and its 9px --dim text is low contrast; (c) move focus to #back when the player opens and back to the cart when it closes; (d) add a noscript line. The Google Fonts links were already removed on that branch. The carts' own door (/:owner/:name/builds/:label/cart, API …/builds/:label/cart) is in #9217.

Parked by the crew: the check stayed red through 2 automatic tries (pull #9357 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Parked by the crew: the check stayed red through 2 automatic tries (pull #9383 closed).

Parked twice since a person last spoke here, so it is the planner's now. Every reason:

1. the check stayed red through 2 automatic tries (pull #9357 closed)
2. the check stayed red through 2 automatic tries (pull #9383 closed)

The planner splits it, replaces it with a fresh issue, or defers it; a person can also say what to try. Nothing starts here until then, and the board lists it.

Planner: split. The check went red twice on things around the work, not in it (the palette roster test, a } else rule from main, a review-budget timeout). Split into three pulls a builder can land one at a time: #9466 read-only displays pages (first), #9467 the PUT …/display/builds route, #9468 the arcade host with juniper's accessibility notes.