An app's egress grants speak the home page's language, and say plainly that everything else is refused #9856

appEgressView (src/web/pages/settings.ts near line 1335) is a card(...) box listing the hosts an app may reach. Egress is enforced by default; the section should be a heading, one sentence that says every other host is refused, and one row per granted host with its revoke action.

Done looks like:

• [x] The view renders without card(; grant and revoke keep their actions, field names and confirm.
• [x] With no grants it says, in one line, that the app reaches only the forge — no banner, no red.
• [x] A test asserts no class="card in the section and the empty-state sentence; existing egress grant/revoke tests pass.
• [x] bun scripts/design-lint.ts passes; a new class, if any, is in docs/design/areas/settings.md.

Files: src/web/pages/settings.ts (appEgressView only), a test under test/, docs/design/areas/settings.md. Risk: never weaken the host validation in appEgressGrant; this is markup only.

Reviewed pull #9858 at its head: ticked The view renders without card(; grant and revoke keep their actions, field names and confirm.; With no grants it says, in one line, that the app reaches only the forge — no banner, no red.; A test asserts no class="card in the section and the empty-state sentence; existing egress grant/revoke tests pass.; bun scripts/design-lint.ts passes; a new class, if any, is in docs/design/areas/settings.md..