eqosys Library: a studio's game, listed after review (the build for #4055) #4075

The build for gap 4 of notes/FULL_CIRCLE.md, designed in apps/eqosys/LIBRARY.md (from #4055). Wait for #4053 (new game from a template): the review's first check drives the harness the template ships.

One PR, in this order:

1. A listings table (D1 migration): a studio's game with the same fields as a row in APPS, plus studio_id, state (draft, in review, listed, refused, pulled), note (the reviewer's words) and times.
2. appsOf(conf): APPS plus the listed rows, read once a minute per isolate. Every appOf caller that decides who signs in or what a page may call (oauth.ts, handle.ts, door.ts and its CORS set, members.ts, the Qollab doors) asks it. A draft or a game in review answers only for its own studio's members.
3. Tools in src/tools.ts: eq_listing_save (a studio's owner or admin), eq_listing_send (to review), eq_listing_review (super admin: list, or refuse with a note), eq_listing_pull (super admin, or the studio for its own).
4. The Library's rows and the Studio shelf read appsOf; a listed game's tile says which studio made it.
5. One journey test: a studio saves a game, its member signs in from its origin, a stranger can't, the super admin lists it, the stranger can, a pull stops it.

The owner's calls, with the defaults the design took (say if any is wrong):

• Only the super admin reviews for now (no reviewer role).
• A studio's game starts as experimental and only with play; never member, a native scheme, or featured from the studio.
• Reports from a studio's game go to that studio in eqosys, not to issues on this repo.
• A pulled game's saves are kept 30 days, then erased.