An admin reads the last 20 refused first asks on /forges/refused #11611

An admin can now read the last 20 refused first asks at GET /forges/refused, and the earlier red check is fixed. I haven't booted the app or fetched the page.

Cause of the red check: the earlier tries edited scripts/hollow-allow.ts. That made scripts/fast.ts call the diff unbounded, so the forge ran the full test tier. The checks API shows that run was stopped for using 19.4 cores against a 16-core limit. The tests themselves passed locally.

What changed

• Page: src/web/pages/forges-refused.ts makes one listRefusals call for the newest 20 rows. Each row shows the time, the actor, the ask as escaped text and the reason. An empty list is one quiet line. Non-admins and signed-out visitors get the not-found page, the same answer /forges gives them.
• Route: one router.add line in src/http/server.ts, placed before the /forges/:name routes.
• Reachability: /system now shows admins a link to the page. The audit therefore passes with no allowlist entry, and hollow-allow.ts is back to its main state.
• Tests: test/forges-refused.test.ts has five tests. They cover the 20-row cap and ordering, the empty list, non-admin parity with /forges, <script> rendered as text, and no email or claim code in the output.
• Docs: docs/features/forges-refused.md describes the page and its door.

Checks: tsc, scripts/gate.ts, design-lint, hollow.ts and the tests for this page, the hollow audit and /system all pass. I have not run the full suite.

Left out

• The /system link has no test of its own. The hollow audit covers it.
• /forges still doesn't link here. That belongs to #11587.
• There is no terminal screen.
• The diff still touches server.ts, so the fast tier will pick about 1,900 test files (my estimate is about 160 minutes) rather than a handful. That is bounded but large, and I couldn't avoid it because the issue requires the route there.

To try it: sign in as an admin, open /system and follow "Refused first asks", or go straight to /forges/refused. Rows appear only after a stranger's first ask has been refused.

Closes #11586

An admin can now read the last 20 refused first asks at GET /forges/refused, and the earlier red check is fixed. I haven't booted the app or fetched the page.

Cause of the red check: the earlier tries edited scripts/hollow-allow.ts. That made scripts/fast.ts call the diff unbounded, so the forge ran the full test tier. The checks API shows that run was stopped for using 19.4 cores against a 16-core limit. The tests themselves passed locally.

What changed

• Page: src/web/pages/forges-refused.ts makes one listRefusals call for the newest 20 rows. Each row shows the time, the actor, the ask as escaped text and the reason. An empty list is one quiet line. Non-admins and signed-out visitors get the not-found page, the same answer /forges gives them.
• Route: one router.add line in src/http/server.ts, placed before the /forges/:name routes.
• Reachability: /system now shows admins a link to the page. The audit therefore passes with no allowlist entry, and hollow-allow.ts is back to its main state.
• Tests: test/forges-refused.test.ts has five tests. They cover the 20-row cap and ordering, the empty list, non-admin parity with /forges, <script> rendered as text, and no email or claim code in the output.
• Docs: docs/features/forges-refused.md describes the page and its door.

Checks: tsc, scripts/gate.ts, design-lint, hollow.ts and the tests for this page, the hollow audit and /system all pass. I have not run the full suite.

Left out

• The /system link has no test of its own. The hollow audit covers it.
• /forges still doesn't link here. That belongs to #11587.
• There is no terminal screen.
• The diff still touches server.ts, so the fast tier will pick about 1,900 test files (my estimate is about 160 minutes) rather than a handful. That is bounded but large, and I couldn't avoid it because the issue requires the route there.

To try it: sign in as an admin, open /system and follow "Refused first asks", or go straight to /forges/refused. Rows appear only after a stranger's first ask has been refused.

Declined: pull #11611 is blocked by a failure outside this change, and I can't clear it without widening the egress list or editing unrelated spawn code. Run log: https://forge.open-platform.sh/trevato/forge/runs/01m789raj951zaav23ez3s7qkz