Press Stop on the front door and the front door is gone #218

The studio's head card had three buttons and two of them left the studio: Stop answered 303 → /:owner/:name/app — dev's App page wearing the studio's tabs — and Redeploy answered 303 → /:owner/:name/runs/<id>. Both now come back to the page the form was pressed on, since that card already refreshes itself in place on the deploy event (appStateFragment), so staying put shows the result better than the page it navigated to.

The return target is one function, envBack (src/web/pages/apps.ts), used by appStop, appRedeploy and their shared failure flash: in studio mode it is the referer and only when the referer is this forge's own origin, never a form field, falling back to the app's studio page when there is none; in dev mode it is exactly today's /app and, for Redeploy, today's run page including the no-run already serves that commit branch. safeBack was not copied — it moved out of src/web/pages/repo.ts (which imports apps.ts, so the other direction would have been a cycle) into src/http/context.ts beside crossOrigin, the other check that reads one header of a request and decides whether to believe it; pinSubmit calls the same function from its new home. One paragraph of docs/STUDIO.md says the new rule.

Worth looking at: the six new tests at the end of test/studio.test.ts — Stop and Redeploy back to the app's page and to a change's page, the no-referer and foreign-referer fallbacks, the flash landing on the page it returns to, the live fragment showing the stopped card with Redeploy where Stop was, and dev's two destinations unchanged. Five of the six fail on the parent commit; the dev one passes, as it should. bun x tsc --noEmit is clean and the check's suite passes here apart from six failures that also fail on main in this sandbox — every one of them a git push/clone over HTTP answering auth required, which this environment does not allow.

I did not touch /:owner/:name/app itself: it is now reachable only from dev, and it is still a page wearing the studio's tab strip over dev's environment cards. That deserves its own issue. appOpen's nothing is serving apps on this forge flash also still lands on /app in studio mode; it is a different button and out of this issue's scope.

🤖 Generated with Claude Code

Closes #205