e2e: cover app-scoped grants for rev-0 short names (follow-up to #74) #75

From PR Reviewer on #74 (LOW): self-host-short-names.spec.ts only tests the org owner. Add an app-scoped API key case with releasedClient (like team-registry.spec.ts:164) expecting empty catalog, 404 on source, refused copy. Also: note the ambiguous-name refusal is unreachable on self-host (http.ts:171-175); drop 'public' in wire-revision.ts:103 comment; narrowed copy (http.ts:381-389) reads storage 3x where 2 would do.