The terminal's deploys screen lists the hosts an app's code reached without declaring them, while egress is only reported, as the app's page does #7493

The terminal's deploys screen now draws a "Reached, not declared" group for a writer, and I've pushed it. bun x tsc --noEmit, bun scripts/design-lint.ts and the two deploys test files (tui-deploys-egress and tui-deploys) pass here; I did not run the full suite.

What it draws:

• Rows: one row per host the app's code reached without declaring it, in the form api.example.com:443 · 2× · last seen 3m ago.
• Closing line: Add them to the egress list in forge.json: ["api.example.com"]. Ports 80 and 443 are written without the port.
• Which hosts: it uses the app page's own filter, so a host declared since is dropped, and the count and last-seen time come from reachedHosts. Nothing is drawn when none remain.
• Who sees it: only someone who canWrite the repository. Readers and guests see none of it.
• Where in the code: the group goes under the head lines in src/tui/screens/deploys.ts. It is read in read(), so it is one read per screen open and per r refresh.

Test: test/tui-deploys-egress.test.ts notes two hosts under a temp data directory. It checks the rows and the closing line for a writer, and no group for a reader or a guest. A second test checks that nothing is drawn before any host is reached.

Left out: the page's "let through while egress is only reported" sentence, because the issue asked for a single closing line. Because I put the group in the head block, a long list pushes the deploy list down; if #7418, #7465 or #7475 also grow the head block, this group may need to move.

Closes #7486

The terminal's deploys screen now draws a "Reached, not declared" group for a writer, and I've pushed it. bun x tsc --noEmit, bun scripts/design-lint.ts and the two deploys test files (tui-deploys-egress and tui-deploys) pass here; I did not run the full suite.

What it draws:

• Rows: one row per host the app's code reached without declaring it, in the form api.example.com:443 · 2× · last seen 3m ago.
• Closing line: Add them to the egress list in forge.json: ["api.example.com"]. Ports 80 and 443 are written without the port.
• Which hosts: it uses the app page's own filter, so a host declared since is dropped, and the count and last-seen time come from reachedHosts. Nothing is drawn when none remain.
• Who sees it: only someone who canWrite the repository. Readers and guests see none of it.
• Where in the code: the group goes under the head lines in src/tui/screens/deploys.ts. It is read in read(), so it is one read per screen open and per r refresh.

Test: test/tui-deploys-egress.test.ts notes two hosts under a temp data directory. It checks the rows and the closing line for a writer, and no group for a reader or a guest. A second test checks that nothing is drawn before any host is reached.

Left out: the page's "let through while egress is only reported" sentence, because the issue asked for a single closing line. Because I put the group in the head block, a long list pushes the deploy list down; if #7418, #7465 or #7475 also grow the head block, this group may need to move.

All three points from the review are done, and the change is pushed on the same branch. tsc is clean, and the egress and deploys tests pass: the new tui-deploys-egress file and tui-deploys, plus the other egress tests. I did not run the full suite.

• Mode sentence: the deploys screen now says whether the reached hosts were let through or are refused. It uses the page's two sentences, chosen by egressSetting(db), which is also what the page passes. The sentence sits between the host rows and the "Add them to the egress list" line.
• One shared function: undeclaredHosts(dataDir, repoId, declared) in src/apps/egress_report.ts returns { reached, entries }, and egressModeSentence(mode) returns the wording. egressNote on the page and the screen both call them, so the two can't drift.
• Tests: a new test in test/tui-deploys-egress.test.ts stores cells.egress as report, then as enforce, and checks each sentence appears and the other doesn't. In the existing writer test I added a comment that reachedHosts lists the most recent host first, which is why db comes before api in the entries array.

I didn't exercise the page itself beyond the shared helper, so its HTML is untouched apart from calling it.