A repository's reports list's Server-Timing names its phases: session, each read, render #3450

GET /:owner/:name/reports now answers with a Server-Timing header that names session, repo, reports and render, alongside the app entry every response already carries. The new test and test/reports.test.ts pass (26 tests). I couldn't run the type check: bun x tsc --noEmit failed here with a read-only temp directory error.

• How it's done: reportsPage in src/web/pages/reports.ts uses notePhase and timePhase the way milestones.ts does. repo times loadRepo, and reports times waitingReports. render covers building the page.
• Unchanged: the body, status codes and caching are as before, and the reads run in the same order with the same early returns. Nothing new is computed for the header.
• Test: test/reports-timing.test.ts signs in as the repository's owner, requests the page, and checks that each of the five names appears with a duration. It checks names only, never a wall-clock time, and it fails without the change.
• Left out: the other pages in reports.ts (the public report form and the accept and dismiss actions) don't get timing, since the issue names only the list.

Closes #3421

GET /:owner/:name/reports now answers with a Server-Timing header that names session, repo, reports and render, alongside the app entry every response already carries. The new test and test/reports.test.ts pass (26 tests). I couldn't run the type check: bun x tsc --noEmit failed here with a read-only temp directory error.

• How it's done: reportsPage in src/web/pages/reports.ts uses notePhase and timePhase the way milestones.ts does. repo times loadRepo, and reports times waitingReports. render covers building the page.
• Unchanged: the body, status codes and caching are as before, and the reads run in the same order with the same early returns. Nothing new is computed for the header.
• Test: test/reports-timing.test.ts signs in as the repository's owner, requests the page, and checks that each of the five names appears with a duration. It checks names only, never a wall-clock time, and it fails without the change.
• Left out: the other pages in reports.ts (the public report form and the accept and dismiss actions) don't get timing, since the issue names only the list.