Serve private pages to readers with a token

lib/private-server.ts serves the private root to a repo's owner,
collaborators and readers (lib/access.ts, the rule can_read applies)
who show a token, as Authorization: Bearer or as basic auth with the
token for password or user name, and are still users of the forge. A
token for one repo reads that repo only. Pages get the headers Caddy
gives pages (ETag, 304s, a byte range for code.db, through lib/static.ts)
with Cache-Control "private, no-cache", which keeps them out of shared
caches.

Caddy serves a file of www when there is one and hands any other path
to it, so it needs no list of private repos, and every missing page,
public or not, gets the same 404 from one place: no token, a bad,
expired or revoked one, a token of a user whose keys are gone, someone
else's private repo and a page that isn't there all look alike, byte
for byte. start.sh and provision.sh run it as git. demo/serve.ts hands
it its misses the same way, and the code search bench can send a token,
so private-web-range reads a private code.db in ranges.

commit

dcbb5255e4f0f8bc79fcbf7975dcb7184e22106b

parent

244787abfb892215ef648f0a06415435f0657488

author

cat <admin@dev.site>

kind

feat risk score 2.1 of 3, Jev's estimate