Where visitors come from, for the forge and for one app, speaks the home page's language #9898

The sources view no longer draws boxes: src/web/pages/sources.ts has no card( left, so neither the forge page nor the per-app page renders class="card" or card-body. I haven't opened either page in a browser or checked the app page's heading count. bun x tsc --noEmit, bun scripts/design-lint.ts, bun scripts/gate.ts, test/traffic-sources.test.ts and the new test/sources-language.test.ts pass.

What changed

• Panels: Visits, Source, Medium, Campaign, Landing page, exits, outbound clicks, "A path to a goal" and GitHub are each a plain section with an <h2>. Each holds its table, or "None in the window." when empty.
• Empty window: "No visits recorded…" is now a plain paragraph instead of the boxed empty state.
• Unchanged: Choosing a value still filters, the visits chart still renders, and every visitor value is still escaped. The access checks are untouched, so only an admin reaches the forge view and only those who administer the app reach the app view.
• Test: test/sources-language.test.ts checks the forge page for one <h1>, no card classes, an <h2> for each panel, the chart, and a <script> source and a <b> campaign coming out escaped. It fails against main's version, which still draws cards and has no such <h2>s.

What I left out

• The new test doesn't fetch the per-app page. That page uses the same body renderer, but its heading comes from settingsPageResponse, which I didn't change, so its single <h1> is unchecked.
• I changed no other files.

To try it

• Sign in as an admin and open /settings/traffic/sources.
• Open an app's /:owner/:name/settings/app/traffic.

Closes #9891

The sources view no longer draws boxes: src/web/pages/sources.ts has no card( left, so neither the forge page nor the per-app page renders class="card" or card-body. I haven't opened either page in a browser or checked the app page's heading count. bun x tsc --noEmit, bun scripts/design-lint.ts, bun scripts/gate.ts, test/traffic-sources.test.ts and the new test/sources-language.test.ts pass.

What changed

• Panels: Visits, Source, Medium, Campaign, Landing page, exits, outbound clicks, "A path to a goal" and GitHub are each a plain section with an <h2>. Each holds its table, or "None in the window." when empty.
• Empty window: "No visits recorded…" is now a plain paragraph instead of the boxed empty state.
• Unchanged: Choosing a value still filters, the visits chart still renders, and every visitor value is still escaped. The access checks are untouched, so only an admin reaches the forge view and only those who administer the app reach the app view.
• Test: test/sources-language.test.ts checks the forge page for one <h1>, no card classes, an <h2> for each panel, the chart, and a <script> source and a <b> campaign coming out escaped. It fails against main's version, which still draws cards and has no such <h2>s.

What I left out

• The new test doesn't fetch the per-app page. That page uses the same body renderer, but its heading comes from settingsPageResponse, which I didn't change, so its single <h1> is unchecked.
• I changed no other files.

To try it

• Sign in as an admin and open /settings/traffic/sources.
• Open an app's /:owner/:name/settings/app/traffic.

The sources view now renders as plain sections instead of cards, on both the forge page and the per-app page. src/web/pages/sources.ts no longer calls card(, and the rendered pages have no class="card" or card-body.

The check failed because the gate wants a "Try:" line in a commit message. I added one in a new empty commit and pushed it. I haven't run the check again, so I don't know yet whether it now passes. The gate and the tests passed locally before the first push, and the new commit changes no code.

What changed

• Each panel (Visits, Source, Medium, Campaign, Landing page, exits, outbound clicks, "A path to a goal", GitHub) is a plain section with an <h2> and its table, or "None in the window." when empty.
• The empty-window message is a plain paragraph instead of a boxed empty state.
• Filtering by a value, the visits chart and escaping of visitor values (referrer, campaign, path) are unchanged. So are the access checks: only an admin reaches the forge view, and only those who administer the app reach the app view.

Tests

• test/sources-language.test.ts is new. It checks the forge page for one <h1>, no card classes, an <h2> for each panel and the chart. It also checks that a <script> source and a <b> campaign come out escaped. It fails against main's version, which still draws cards.
• test/traffic-sources.test.ts still passes. tsc --noEmit, bun scripts/design-lint.ts and bun scripts/gate.ts were clean.

Left out

• The new test doesn't fetch the per-app page. That page shares the body renderer, but its heading comes from settingsPageResponse, which I didn't change, so its single <h1> is unchecked.
• I changed no files beyond sources.ts and the new test.

To try it

• Sign in as an admin on the preview and open /settings/traffic/sources.
• Then open an app's /:owner/:name/settings/app/traffic.

I addressed all four of juniper's points, and the per-app page is now tested too. tsc, design-lint, gate and both traffic test files pass locally (19 tests). I haven't looked at either page in a browser, and I haven't seen the forge's check result for this push yet.

• Per-app page: test/sources-language.test.ts now creates a repo and an app. It checks /ada/notes/settings/app/traffic for one <h1>, no card classes and an <h2> for each panel. It also checks that the chart renders, that a <script> source comes out escaped and that the empty text appears.
• Repeated title: each panel's title now appears only in its <h2>. I removed the sr-only caption and changed the column header to "Value".
• Empty window: it is now one plain muted sentence, "No visits recorded for this forge in 7 days." (or "this app"). I dropped data-empty and the extra note.
• Test imports: the two imports from views_store.ts are merged into one.
• Empty text: the forge page test now asserts the "No visits recorded" sentence.

I didn't disagree with anything. The commit message has a "Try:" line, which the gate needs for this file.

To try it

• Sign in as an admin on the preview and open /settings/traffic/sources.
• Then open an app's /:owner/:name/settings/app/traffic.