Hidden accounts: their app hosts answer as unknown; a fork names its parent only while readable #870

Follow-ups 2 and 3 from the #858 review (#831). Stacked on #858: this branch carries #858's commit, so merge it after #858. Only the last commit is new.

• App hosts. An app whose repository's owner is suspended or removed has no host. Its slug host answers as unknown and a verified custom domain answers as the forge itself, rather than with a "not running" page that says an app lives there (shown in src/apps/proxy.ts).
• A fork's parent. Every place that read a fork's parent by id now asks forkParentFor, which names the parent only while the viewer may read it:

- the new-pull page and its submit, which now propose within the fork; - the following card's submit, and the API's converge; - take-updates and sync; - propose-upstream; - the fork event's line in the activity rail and in the Atom feed.

Not here: follow-up 1 (an org whose only owner is suspended) needs a decision on whether OWNER_STANDING should hold for such orgs.

Tests: test/suspended-hidden.test.ts. The app's host answers before the suspension and is unknown during it. The fork's new-pull page offers its parent before and not during. The activity rail no longer names the hidden parent. All of these fail without the change.

🤖 Generated with Claude Code