A display launches into the arcade host, playable by keyboard and on a phone #9468

Last slice of #9208.

Done looks like:

• [x] src/display/launch.ts, src/arcade/host.ts, src/arcade/snapshot.ts, src/arcade/arcade.html and src/arcade/jbox-spin.js come from origin/incoming/jay-main, wiring adapted only; the display page links "Launch" to the host and the host answers with the securityFloor headers (its CSP allows only what it needs, no third-party fonts).
• [x] Juniper's notes on #9217 are met: carts off the front of the carousel stay reachable (prev/next buttons or focusable); the "Z X BUILD" hint has a phone equivalent and meets contrast; focus moves to #back when the player opens and back to the cart when it closes; a noscript line says what needs JavaScript.
• [x] A test launches a seeded display and asserts the host page lists its carts and carries the CSP.
• [ ] bun scripts/design-lint.ts passes; commits carry Co-authored-by: Jay Moran; the pull gives the preview URL of a launched display.

Files: src/display/launch.ts, src/arcade/*, src/http/server.ts, docs/design/areas/displays.md, test/arcade-host.test.ts. Risks: the host serves third-party cart code; keep it on its own path with a sandboxed iframe or a CSP that cannot reach the forge's cookies.

Parked by the crew: the check stayed red through 2 automatic tries (pull #9554 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Reviewed pull #9570 at its head: ticked src/display/launch.ts, src/arcade/host.ts, src/arcade/snapshot.ts, src/arcade/arcade.html and src/arcade/jbox-spin.js come from origin/incoming/jay-main, wiring adapted only; the display page links "Launch" to the host and the host answers with the securityFloor headers (its CSP allows only what it needs, no third-party fonts).; Juniper's notes on #9217 are met: carts off the front of the carousel stay reachable (prev/next buttons or focusable); the "Z X BUILD" hint has a phone equivalent and meets contrast; focus moves to #back when the player opens and back to the cart when it closes; a noscript line says what needs JavaScript.; A test launches a seeded display and asserts the host page lists its carts and carries the CSP.. left open: bun scripts/design-lint.ts passes; commits carry Co-authored-by: Jay Moran; the pull gives the preview URL of a launched display. — The earlier commits on the branch lack the Jay Moran trailer, and the pull gives no preview URL of a launched display..

Left open after pull #9570 landed: 1 unticked item remains (bun scripts/design-lint.ts passes; commits carry Co-authored-by: Jay Moran; the pull gives the preview URL of a launched display.). The planner files each as its own issue and closes this one; a person may close it, tick what is done, or say what is left. Until then the crew does not pick it again.

Closed without a follow-up. The open box was about how the pull was written up, not about the work. design-lint already runs in the check on every push that touches src/web/, commits that have already landed can't get new co-author lines, and the launched display can be tried on production. Nothing is left for a builder.