The /apps list answers a warm request under 50 ms and works with JavaScript off, and a test holds both #9757

I added test/apps-nojs.test.ts, which holds the warm-speed and no-script claims for /apps. Both tests passed on main as it stands, so src/web/pages/apps.ts is untouched.

• Warm speed: a signed-in user loads /apps twice with three apps. The second answer must send the app phase of Server-Timing, read the way appMs does in test/search-page.test.ts, and it must not be NaN. The statement count from requestStatements is capped at 60 with expectWork. After six more apps are added, the count must not exceed the first one, so it can't grow per app. No wall clock is involved (#4429).
• No script: with <script> blocks stripped, every app is a plain <a href>, and the markup has no inline on*= handler and no javascript: or # link.
• New-app step: the form is not on the list page itself. The list links to /apps/new, and the test checks that page has <form method="post" action="/apps/new">. A cross-origin POST there gets 403, and a same-origin one doesn't.
• Checks: test/apps-timing.test.ts, test/apps-fit.test.ts, bun scripts/design-lint.ts and bun x tsc --noEmit all pass. The phone-width look in apps-fit is skipped because no Chromium starts in this sandbox.

I left out any wall-clock bound, and I didn't start real processes: the apps are seeded records.

To try it: bun test test/apps-nojs.test.ts.

Closes #9752

I added test/apps-nojs.test.ts, which holds the warm-speed and no-script claims for /apps. Both tests passed on main as it stands, so src/web/pages/apps.ts is untouched.

• Warm speed: a signed-in user loads /apps twice with three apps. The second answer must send the app phase of Server-Timing, read the way appMs does in test/search-page.test.ts, and it must not be NaN. The statement count from requestStatements is capped at 60 with expectWork. After six more apps are added, the count must not exceed the first one, so it can't grow per app. No wall clock is involved (#4429).
• No script: with <script> blocks stripped, every app is a plain <a href>, and the markup has no inline on*= handler and no javascript: or # link.
• New-app step: the form is not on the list page itself. The list links to /apps/new, and the test checks that page has <form method="post" action="/apps/new">. A cross-origin POST there gets 403, and a same-origin one doesn't.
• Checks: test/apps-timing.test.ts, test/apps-fit.test.ts, bun scripts/design-lint.ts and bun x tsc --noEmit all pass. The phone-width look in apps-fit is skipped because no Chromium starts in this sandbox.

I left out any wall-clock bound, and I didn't start real processes: the apps are seeded records.

To try it: bun test test/apps-nojs.test.ts.