Explorer filters live in the URL: a filtered view is a link, opens server-rendered, and survives a reload #11853

The explorer already did most of this; I added the one missing piece, a chip row of the active filters with each remove as a link. tsc, the design lint, the gate, and the explore and MCP-size tests pass. The explore speed test also passes, but I did not time the page against the seeded forge.

Already on main, left alone:

• Filters in the URL: kind, sort, text, archived, updated (also as since) and owner are query parameters, validated at the boundary (exploreLineFrom and readExploreLine in src/actions/explore.ts).
• First paint: /explore renders on the server with the filter applied, so it needs no JavaScript.
• MCP tool: explore takes the same parameters in the same words.
• Tests: per-filter and hostile-value tests already exist in test/explore-url.test.ts.

What I added, in src/web/studio/explore.ts:

• Chip row: a chip per active filter (kind, sort, archived, updated, owner, each text word), shown only when something is filtered. Each chip's "×" links to the same view without that filter.
• Test: a new case in test/explore-url.test.ts covers the chip row and checks a hostile q value is escaped.

What I did not do: an unknown filter value still gives a 400 status. Three existing contracts rely on that: the page, the API and the MCP all answer 400 and name the allowed words (test/explore-parity.test.ts pins it). The page still draws the full results with a plain note. Turning the page's 400 into a 200 is a deliberate change to that contract, so I left it for you to decide.

To try it: open /explore?kind=app&sort=forks&q=garden and click a chip's × to drop that filter.

Closes #11819

The explorer already did most of this; I added the one missing piece, a chip row of the active filters with each remove as a link. tsc, the design lint, the gate, and the explore and MCP-size tests pass. The explore speed test also passes, but I did not time the page against the seeded forge.

Already on main, left alone:

• Filters in the URL: kind, sort, text, archived, updated (also as since) and owner are query parameters, validated at the boundary (exploreLineFrom and readExploreLine in src/actions/explore.ts).
• First paint: /explore renders on the server with the filter applied, so it needs no JavaScript.
• MCP tool: explore takes the same parameters in the same words.
• Tests: per-filter and hostile-value tests already exist in test/explore-url.test.ts.

What I added, in src/web/studio/explore.ts:

• Chip row: a chip per active filter (kind, sort, archived, updated, owner, each text word), shown only when something is filtered. Each chip's "×" links to the same view without that filter.
• Test: a new case in test/explore-url.test.ts covers the chip row and checks a hostile q value is escaped.

What I did not do: an unknown filter value still gives a 400 status. Three existing contracts rely on that: the page, the API and the MCP all answer 400 and name the allowed words (test/explore-parity.test.ts pins it). The page still draws the full results with a plain note. Turning the page's 400 into a 200 is a deliberate change to that contract, so I left it for you to decide.

To try it: open /explore?kind=app&sort=forks&q=garden and click a chip's × to drop that filter.

Both blockers and the four smaller points are fixed and pushed. The page now answers 200 with the note and the unfiltered results for an unknown filter. tsc, the design lint, and the explore and MCP-size tests pass.

• Unknown filter: /explore?kind=bogus (and an unknown sort or updated) returns 200 with a plain note, and the list is the unfiltered one. The API and the MCP tool still return 400 and name the allowed words. I changed test/explore-parity.test.ts and the bad-since and bad-sort cases in test/explore-url.test.ts to expect 200 for the page only.
• Hostile-value test: a new test in test/explore-url.test.ts covers an unknown kind, sort, updated and since, plus an escaped <script> kind. Each is 200, shows the note, lists the same rows as the bare page, and leaves the script escaped.
• Doc comment: the removable comment is back above removable, and chipRow has its own one-line comment.
• Chip row: it is now role="group" with its aria-label. Each chip's "×" is aria-hidden, and the link carries aria-label="Remove filter kind:app". The visible text is still kind:app, so it still reads as syntax. I did not reword it, since the term is also what the user types in the search box.
• Timing: I measured over 20 requests on the in-process seeded test forge, not on the preview. The median is 3.0 ms for /explore, 3.4 ms for a filtered view and 2.8 ms for ?kind=bogus. The slowest single request was 25.5 ms. I can't reach the preview's 2.5 s from here. It is far above these numbers, so I'd read it as a cold start or a slower machine than the code, but I haven't confirmed that.