+ New forge: spawn a child from a page — plan first, then the claim link once #855

Closes #426

"+ New forge": the page a forge's admin spawns a child from. It is the same door as POST /api/v1/forges and the MCP spawn, as a form that works without JavaScript:

• name, direction, apps, crew, keep access, and an optional API key with its budget
• See the plan first, then Spawn
• the claim link is shown once on the page, never in a URL and never cached
• the page says plainly what never travels

The path: the owner wants to send someone a forge. From the "+" menu he opens New forge, fills in the name and apps, sees the plan, spawns it, and copies the one link to send.

Work in progress. This first commit is the refusing tests. The page, the menu entry and the looks follow.