Say how far behind a fork is, next to Update from parent #17

The drift counts this issue asks for landed earlier (forkDrift, the Fork-of row's note, and the hidden/explained Update button); this pull finishes the issue by closing the leak that row opened and folding its rules into one place.

forkParentFor and visibleForks in src/core/repos.ts now put canRead in front of a fork's lineage and of its fork list, and the page header (src/web/chrome.ts), the two fork views (src/web/pages/repo.ts) and the API's fork list all ask through them — three copies of the same filter are gone. Before this, a private repository forked and then opened published its parent's name, its link and how many commits it had moved, and the fork bar counted private forks the list beneath it would never show. src/web/pages/repo.ts also reads the tree and the drift together, since neither waits on the other.

Two tests in test/forks.test.ts cover it — a public fork of a private parent, read as a stranger and as its owner, and a private fork missing from the parent's count for a stranger but present for its owner; both fail without the source change (verified by stashing it). The existing behind / current / diverged rail test is unchanged, with its two page helpers hoisted so the new tests share them. bun x tsc --noEmit is clean and the forks, repos and fork-flow suites pass. Running the whole check list here gives the same seven failures before and after this change (web, crew, apps, pulls, cross-repo-pull): they are pre-existing in this sandbox — the web one fails on http://ada:undefined@… clone auth — and none of them are touched by these commits.

🤖 Generated with Claude Code

Closes #1