Opening an app's environment through the API names its Server-Timing phases: session, repo, open #5385

GET /api/v1/repos/{owner}/{name}/app/{env}/open now names session, repo and open in its Server-Timing header. The new test file and the existing test/apps-api.test.ts passed when I ran them. I haven't run bun x tsc --noEmit successfully: it failed here on a missing bun type definition, and the forge's check will run it on this push.

• What changed: the handler in src/http/api.ts marks session with notePhase/takeSessionTime, then wraps loadRepo as repo and openEnvUrl as open with timePhase, the same way GET /api/v1/returns does. Nothing else in api.ts is touched. The { url } answer, the 422 refusal and the 404 are unchanged.
• Tests: test/api-app-open-timing.test.ts is shaped like api-runs-timing.test.ts. It asserts three cases:

- Opening production as a writer returns session, repo, open in that order, with a string url. - An unknown environment is still a 422 and names all three phases. - A missing repository is a 404 naming only session, repo. - The test starts an AppsRuntime and registers an app record directly, because openEnvUrl returns 422 without a runtime. I didn't run the first case against the old handler, so "fails without the change" is reasoned from the old code rather than observed.

• Left out: no render phase, since the issue asked for these three only. Nothing else near #5316 or #3782 is touched.
• Try it: bun test test/api-app-open-timing.test.ts, or curl -i the route and read server-timing.

Closes #5361

GET /api/v1/repos/{owner}/{name}/app/{env}/open now names session, repo and open in its Server-Timing header. The new test file and the existing test/apps-api.test.ts passed when I ran them. I haven't run bun x tsc --noEmit successfully: it failed here on a missing bun type definition, and the forge's check will run it on this push.

• What changed: the handler in src/http/api.ts marks session with notePhase/takeSessionTime, then wraps loadRepo as repo and openEnvUrl as open with timePhase, the same way GET /api/v1/returns does. Nothing else in api.ts is touched. The { url } answer, the 422 refusal and the 404 are unchanged.
• Tests: test/api-app-open-timing.test.ts is shaped like api-runs-timing.test.ts. It asserts three cases:

- Opening production as a writer returns session, repo, open in that order, with a string url. - An unknown environment is still a 422 and names all three phases. - A missing repository is a 404 naming only session, repo. - The test starts an AppsRuntime and registers an app record directly, because openEnvUrl returns 422 without a runtime. I didn't run the first case against the old handler, so "fails without the change" is reasoned from the old code rather than observed.

• Left out: no render phase, since the issue asked for these three only. Nothing else near #5316 or #3782 is touched.
• Try it: bun test test/api-app-open-timing.test.ts, or curl -i the route and read server-timing.