The app's studio page shows a new deployment arriving without a reload #53

Pushed successfully.

The studio app page's head card and previews list now render from one shared function (appPanels in src/web/pages/studio.ts), used both for the page's first paint and a new fragment endpoint GET /:owner/:name/app/state. The page's live client (src/web/live.ts) recognizes a run.* event whose payload is a deploy for the app being viewed, fetches that fragment, and swaps #app-head/#app-previews in place — coalescing to at most one fetch in flight during a burst of events, leaving the pill to handle everything else.

The fragment carries the security floor's headers (referrer-policy, x-content-type-options, on top of the CSP fragment() already set) and is authorized exactly like the page: a viewer who can't see the app gets the same 404 both places. With JavaScript off, behavior is unchanged — the refresh pill still covers it.

Tests added: test/studio.test.ts covers the fragment rendering for an authorized viewer vs. a 404 for a stranger, and a preview flipping from deploying to live between two fetches with its open-link intact. test/live-pages.test.ts gains a check that the studio app page wires the live client with data-app="1". docs/STUDIO.md notes the page keeps itself current. bun test and tsc --noEmit pass; the check suite's pre-existing git-auth failures in test/pulls.test.ts/test/apps.test.ts reproduce identically on main and are unrelated to this change (sandbox git auth, not this branch).

Closes #35