The forge panel's proof chain survives a failed send: a rejected fetch or an error answer keeps the token #5889

The panel now keeps its proof token unless an answer brings a new one, so a send the network rejects can be retried and still files as @name. test/apps-feedback.test.ts passes (22 tests). I did not run the type check, because bun x tsc found no bun types in this sandbox.

• Panel (src/apps/toolbar.ts): before, a rejected fetch, or an answer with no x-forge-proof, wiped the token and showed "Reload this page…". Now only an answer's x-forge-proof replaces the held token. I removed that wipe-and-message path, so the PROOF_LOST sentence in src/apps/note_words.ts is gone too.
• Door (src/apps/feedback.ts): no change needed. feedback() already adds the next token to every answer to a valid-proof request, so the bad_request, filtered and rate-limited answers already carry it. The new tests now cover that.

Tests

• A valid-proof chain runs through a rate-limited (429), a bad_request (400) and a filtered (422) answer. Each answer carries a next token, and the next call is still @name.
• A first send the network rejected never reaches the door. The retry with the same proof files as @name, and its answer carries the next token. This is a door-level check; it does not run the panel's script.
• A source-level check on the panel's call() function: it must not clear the token, call broke(), or have a rejection handler. This test fails against the old code.
• I replaced the old "panel says so when its proof chain breaks" test, since that behaviour is gone.

Not done

• I did not run the panel in a browser or a DOM harness. Its behaviour is covered only by that source-level check.
• If a rejected send did reach the server and spend the token, the retry goes as a visitor, and the panel no longer says so.

To try it, load a page of a signed-in app. Cut the network, press Send, then restore the network and send again. The note should file under your @name.

Closes #5355

The panel now keeps its proof token unless an answer brings a new one, so a send the network rejects can be retried and still files as @name. test/apps-feedback.test.ts passes (22 tests). I did not run the type check, because bun x tsc found no bun types in this sandbox.

• Panel (src/apps/toolbar.ts): before, a rejected fetch, or an answer with no x-forge-proof, wiped the token and showed "Reload this page…". Now only an answer's x-forge-proof replaces the held token. I removed that wipe-and-message path, so the PROOF_LOST sentence in src/apps/note_words.ts is gone too.
• Door (src/apps/feedback.ts): no change needed. feedback() already adds the next token to every answer to a valid-proof request, so the bad_request, filtered and rate-limited answers already carry it. The new tests now cover that.

Tests

• A valid-proof chain runs through a rate-limited (429), a bad_request (400) and a filtered (422) answer. Each answer carries a next token, and the next call is still @name.
• A first send the network rejected never reaches the door. The retry with the same proof files as @name, and its answer carries the next token. This is a door-level check; it does not run the panel's script.
• A source-level check on the panel's call() function: it must not clear the token, call broke(), or have a rejection handler. This test fails against the old code.
• I replaced the old "panel says so when its proof chain breaks" test, since that behaviour is gone.

Not done

• I did not run the panel in a browser or a DOM harness. Its behaviour is covered only by that source-level check.
• If a rejected send did reach the server and spend the token, the retry goes as a visitor, and the panel no longer says so.

To try it, load a page of a signed-in app. Cut the network, press Send, then restore the network and send again. The note should file under your @name.