Settings › Access, what outside agents tried, speaks the home page's language #9894

/settings/access now has no card( and no card-body. Its heading, filter form and table follow the other settings pages.

The two existing access tests and the new test/access-language.test.ts pass, 14 in all, and bun x tsc --noEmit is clean. With the page change stashed, the two card-shape tests in the new file fail, so they fail on main as the issue asks. I did not run scripts/gate.ts. I did not run the page against a running app.

• Page: src/web/pages/access.ts shows the one <h1> Access above a <section class="settings-block">. The section holds the <h2> "Outside requests", the intro sentence, the same GET filter form (ua, path) and either the table or "Nothing in the last day."
• Table: it has one row per request in the .table-scroll box, with an sr-only caption and data-dense, like the Scrapes tables. Every user agent and path still goes through html, so it is escaped.
• Design: bun scripts/design-lint.ts is clean. I added no new class, so docs/design/areas/settings.md is unchanged.
• Tests: test/access-language.test.ts signs in as the forge admin and checks:

- one <h1>, no class="card and no card-body inside <main>; - the filter form and its two inputs; - a logged path, with a script-tag user agent escaped; - a non-admin getting 404.

• Empty log: signing in is itself logged, so I reach the empty case with ?ua=no-such-agent. Reaching a truly empty log would mean clearing the log first.

I kept the <h2> "Outside requests" because test/access-log.test.ts still asserts that text. The issue says "one heading", and I read that as one <h1>.

I did not touch the log, its redaction or the MCP access tool.

Closes #9836

/settings/access now has no card( and no card-body. Its heading, filter form and table follow the other settings pages.

The two existing access tests and the new test/access-language.test.ts pass, 14 in all, and bun x tsc --noEmit is clean. With the page change stashed, the two card-shape tests in the new file fail, so they fail on main as the issue asks. I did not run scripts/gate.ts. I did not run the page against a running app.

• Page: src/web/pages/access.ts shows the one <h1> Access above a <section class="settings-block">. The section holds the <h2> "Outside requests", the intro sentence, the same GET filter form (ua, path) and either the table or "Nothing in the last day."
• Table: it has one row per request in the .table-scroll box, with an sr-only caption and data-dense, like the Scrapes tables. Every user agent and path still goes through html, so it is escaped.
• Design: bun scripts/design-lint.ts is clean. I added no new class, so docs/design/areas/settings.md is unchanged.
• Tests: test/access-language.test.ts signs in as the forge admin and checks:

- one <h1>, no class="card and no card-body inside <main>; - the filter form and its two inputs; - a logged path, with a script-tag user agent escaped; - a non-admin getting 404.

• Empty log: signing in is itself logged, so I reach the empty case with ?ua=no-such-agent. Reaching a truly empty log would mean clearing the log first.

I kept the <h2> "Outside requests" because test/access-log.test.ts still asserts that text. The issue says "one heading", and I read that as one <h1>.

I did not touch the log, its redaction or the MCP access tool.

I added the missing "Try:" line in a new commit and pushed it. bun scripts/gate.ts now runs clean locally. I did not rerun the tests, because the commit changes no code.

The gate wanted a commit message with a "Try: <what to open or call on the preview>" line. The new commit's line reads: sign in as the forge admin on the preview and open /settings/access, then filter by user agent or path.

The earlier run of the Access tests and tsc was green. The forge will run the full check on this push.