Every look is a picture of the app's home page, whatever the change touched #295

Pushed.

app.looks in forge.json now names up to three paths worth a picture (["/"] by default, exactly as before). Each named page is captured at every width through the same grant door, named on disk and in its URL by page and kind so two pages of one commit never collide, and recorded with a new page column (default /, migration 28) so every look taken before this field existed reads as exactly what it always was.

What changed:

• src/apps/manifest.ts: validates app.looks at the boundary — path starting with /, no scheme/host, no .., no control bytes, capped length, at most 3 entries (a manifest error beyond that, never a slower deploy).
• src/core/schema.ts, src/core/looks.ts: page column and the lookSlot naming (kind alone for the home page, page-kind otherwise) shared by disk paths and URLs.
• src/looks/service.ts: captures every declared page at every width, pointed at the grant door with to=<page>.
• src/web/pages/looks.ts: the pull's Look card groups by page once there's more than one, each labelled by its path with alt text naming the page; lookImage resolves a picture by its slot rather than kind alone. The studio ask row, board's landed row, and an app's studio head keep showing the home page specifically, whatever else app.looks names.
• docs/APPS.md updated for app.looks and the new URL shape.

Tests added: manifest validation (test/apps-adversarial.test.ts) and an end-to-end two-page capture + grouped-card test (test/looks.test.ts). bun run check (tsc + the declared suite) is green.

One note: test/looks.test.ts (not part of forge.json's check) has one pre-existing failing test — "the studio's look ask leads with the thumb picture" — that fails identically on main before this change; confirmed via git stash that it's unrelated to this work, so I left it as-is.

Closes #264