The studio can make an app but cannot change what it says it is #249

Pushed successfully.

The studio's settings page (/:owner/:name/settings) can now change an app's description and visibility — the two facts it prints most: under the name on the app's own page (dev's repo page), every shelf row, /apps, and the front door.

What changed: src/web/studio/crew.ts gets a new "About" card, admin-only, that posts to the very same POST /:owner/:name/settings action dev's General settings page already uses (settingsUpdate in src/web/pages/settings.ts) — same authorization (requireRepoAdmin), same same-origin check, no new route. Since that action always sends protect/requireReview/requireChecks, the card carries the repo's current values for those as hidden inputs (the same trick autonomyCard already uses for direction), so saving from the studio can never silently turn off branch protection it never shows.

Out of scope, as the issue named: the app's own environment variables, and disabling/deleting an app — both stay one link away via "the rest of the settings" (?mode=dev).

Tests: test/studio.test.ts — a writer changes description/visibility and sees it reflected on the app's own page, the shelf, and /apps, with branch protection untouched; a reader gets no form and a direct POST is refused (404), matching dev's page. Full bun x tsc --noEmit and the forge's check suite (402 tests) pass.

Closes #230