The apps page's Server-Timing names its phases: session, each read, render #3410

GET /apps now answers with a Server-Timing header naming session, apps, shelf, cost and render, alongside the existing app entry. The new test passes, and tsc --noEmit is clean. I ran only that test, not the whole suite; the forge runs the full check on push.

• Phases: session is the time taken to resolve the session. The three reads are apps (the visible-apps read, appsForViewer), shelf (shelfRows) and cost (costLine plus the writable-apps lookup it takes). render covers building the body and the page. It uses notePhase/timePhase exactly as src/web/pages/milestones.ts does.
• Unchanged: the body, status codes and caching are unchanged, and nothing new is computed for the header. The reads keep their order and their errors. The one move is that costLine now runs just before the body is built instead of inside the template; it still runs after shelfRows.
• Test: test/apps-timing.test.ts signs in, requests /apps, and asserts each phase name appears with a duration. It fails without the change; I checked by stashing the source edit.
• Not done: I didn't split apps into its sub-reads (repo list, app records, environments). It's one function call and one phase for now. I touched no other page.

To try it, run curl -sI -b <session cookie> $FORGE_URL/apps | grep -i server-timing.

Closes #3403

GET /apps now answers with a Server-Timing header naming session, apps, shelf, cost and render, alongside the existing app entry. The new test passes, and tsc --noEmit is clean. I ran only that test, not the whole suite; the forge runs the full check on push.

• Phases: session is the time taken to resolve the session. The three reads are apps (the visible-apps read, appsForViewer), shelf (shelfRows) and cost (costLine plus the writable-apps lookup it takes). render covers building the body and the page. It uses notePhase/timePhase exactly as src/web/pages/milestones.ts does.
• Unchanged: the body, status codes and caching are unchanged, and nothing new is computed for the header. The reads keep their order and their errors. The one move is that costLine now runs just before the body is built instead of inside the template; it still runs after shelfRows.
• Test: test/apps-timing.test.ts signs in, requests /apps, and asserts each phase name appears with a duration. It fails without the change; I checked by stashing the source edit.
• Not done: I didn't split apps into its sub-reads (repo list, app records, environments). It's one function call and one phase for now. I touched no other page.

To try it, run curl -sI -b <session cookie> $FORGE_URL/apps | grep -i server-timing.