Where visitors come from, for the forge and for one app, speaks the home page's language #9891

For: a client reads their app's visitors in plain words. The sources view (/settings/traffic/sources and /:owner/:name/settings/app/traffic, src/web/pages/sources.ts) still draws each panel (sources, mediums, campaigns, landing pages, exits) in boxes, while Settings › Traffic itself moved off them (#9844).

Done looks like:

• [x] Both pages have one <h1>; each panel is a plain section with an <h2> and its table, or "None in the window." when empty.
• [x] src/web/pages/sources.ts no longer calls card(; the rendered pages have no class="card" or card-body.
• [x] Choosing a value still filters by it, the visits chart still renders, and every value from a visitor (referrer, campaign, path) is still escaped.
• [x] Only an admin reaches the forge view and only those who administer the app reach the app view, as today.
• [x] A new test/sources-language.test.ts asserts the above, including a referrer holding <script>, and fails on main today; test/traffic-sources.test.ts still passes; bun scripts/design-lint.ts is clean.

Touch only src/web/pages/sources.ts and the new test.

Reviewed pull #9898 at its head: ticked Both pages have one <h1>; each panel is a plain section with an <h2> and its table, or "None in the window." when empty.; src/web/pages/sources.ts no longer calls card(; the rendered pages have no class="card" or card-body.; Choosing a value still filters by it, the visits chart still renders, and every value from a visitor (referrer, campaign, path) is still escaped.; Only an admin reaches the forge view and only those who administer the app reach the app view, as today.; A new test/sources-language.test.ts asserts the above, including a referrer holding <script>, and fails on main today; test/traffic-sources.test.ts still passes; bun scripts/design-lint.ts is clean..