A public app made private hides its pictures at once (tested); /apps and /asked get the phone tabs #863

Two follow-ups, stacked on #851 (merge that first):

1. From #845's verdict: the flip test. A public app whose pictures were taken as nobody is made private. A reader and a stranger then get 404 on its picture and no Look card on its pull, while its writer still gets the picture and the card. mayFetchLook asks canEnterApp on every fetch, so nothing has to be retaken. The test is in test/looks.test.ts.
2. From #851's verdict: a way back on a phone. /apps and /asked now carry the home's three tabs (Feed, Your apps, Asked), each page with its own tab marked current. The tabs are one helper, studio/home_tabs.ts, used by all three pages, and are hidden on a desk as before. /apps shows them only to someone signed in. Tested in test/home-feed.test.ts.

Local runs: looks, home-feed, asked, studio and the cross files give 298 pass. tsc is clean.

🤖 Generated with Claude Code