Roles, part 3b-ii: a member cannot edit the crew's standing instructions #2441

This change adds a test only; no source changed. Editing an agent's brief (what I took "the crew's standing instructions" to mean) already refuses a non-admin on both surfaces.

• API: PATCH /api/v1/agents/:username returns 403 for a member, through the existing requireForgeAdmin check in src/actions/crew.ts.
• Page: /settings/crew/:username returns 404 for a member, the same "no door" answer the account pages give.
• Not touched: adding a new refusal is what broke test/quotas.test.ts and test/accounts.test.ts in the earlier attempts, so I added none.

New test: test/member-crew.test.ts covers both halves.

• A member's API patch (403), form post (404) and page read (404) all leave the brief unchanged.
• An admin edits the brief through the API (200) and through the form (303), and each edit is stored.

Checks: the new test, test/quotas.test.ts and test/accounts.test.ts pass (35 tests). bun x tsc --noEmit fails here with "Cannot find type definition file for 'bun'" even after bun install, so the type check did not run. The forge's own check will run it.

To try it: bun test test/member-crew.test.ts

Closes #2422

This change adds a test only; no source changed. Editing an agent's brief (what I took "the crew's standing instructions" to mean) already refuses a non-admin on both surfaces.

• API: PATCH /api/v1/agents/:username returns 403 for a member, through the existing requireForgeAdmin check in src/actions/crew.ts.
• Page: /settings/crew/:username returns 404 for a member, the same "no door" answer the account pages give.
• Not touched: adding a new refusal is what broke test/quotas.test.ts and test/accounts.test.ts in the earlier attempts, so I added none.

New test: test/member-crew.test.ts covers both halves.

• A member's API patch (403), form post (404) and page read (404) all leave the brief unchanged.
• An admin edits the brief through the API (200) and through the form (303), and each edit is stored.

Checks: the new test, test/quotas.test.ts and test/accounts.test.ts pass (35 tests). bun x tsc --noEmit fails here with "Cannot find type definition file for 'bun'" even after bun install, so the type check did not run. The forge's own check will run it.

To try it: bun test test/member-crew.test.ts

This pull adds a test that a member cannot edit the crew's standing instructions (an agent's brief), and that an admin can. No source changed, because that edit already refuses a non-admin on both surfaces.

• API: PATCH /api/v1/agents/:username returns 403 for a member, through requireForgeAdmin in src/actions/crew.ts.
• Page: /settings/crew/:username returns 404 for a member, the same "no door" answer the account pages give.
• Not added: a new refusal. That is what broke test/quotas.test.ts and test/accounts.test.ts in the earlier attempts.

test/member-crew.test.ts checks that a member's API patch, form post and page read all leave the brief unchanged. It also checks that an admin's API patch (200) and form post (303) are each stored.

The first push failed the forge's type check: the test read the optional app.config.url. It now uses a plain FORGE_URL constant. tsc --noEmit now passes here. The new test, test/quotas.test.ts and test/accounts.test.ts also pass; I ran the new test again after the fix, but not the other two.

To try it, run bun test test/member-crew.test.ts.