[thorwhalen]

Closes #88 (steps 1, 2 and the HTTP gate; steps 3 and 4 become follow-ups, below).

What: a review page can carry a password, an expiry and a revoke, on caplinks (merged and released as 0.0.3 first: i2mint/caplinks#2).

• publish_review(..., password=, expires=) and heed review publish --password-file F --expires 7d, heed review revoke <id>. Page ids do not change: the record lives in <root>/access/<id>.json, and a page with no record stays open, exactly as before (no behaviour change, caplinks only imported when a record exists or is written).
• heed.review_access.ReviewGate (injectable via make_review_app(gate=)): 401 until POST /pages/{id}/unlock sets a cookie (HttpOnly, SameSite=Strict, name = hash of the id, never past expiry), 410 expired, 404 revoked, 503 (closed) if caplinks is missing. Page, media and thread routes are all gated (make_thread_router(thread_gate=) is the one generic hook added). Wrong passwords: limited per client per page, and a page taking too many from everyone locks for a while.
• The page JS shows a password form on 401. Optional extra heed[gate]; README, skill and data-layout docs updated.
• read_capped in heed.threads is now public (it was _read_capped) to cap the unlock body.

Adversarial review (fresh Opus agent), verdict "fix first", fixed: a publish with a bad password left an open page behind (validation now precedes saving); the cookie name carried the page id to every app on the origin (now a hash); scrypt ran on the event loop (threadpool); revoke crashed on a damaged record (replaced, closed); the temp file was briefly world-readable (mkstemp, 0600); ad hoc id check (now valid_id); lock-out untested (tests added, plus bad-publish, cookie and damaged-record tests); access/ added to the documented data layout. Judged fine and left: CapabilityLinks built per request (cheap), per-process lock-out dict (at most one entry per gated page), Secure from X-Forwarded-Proto (flag only), media Cache-Control up to an hour after a revoke.

Tests: 28 in tests/test_review.py (all pass) plus doctests; the full suite passes except tests/test_widget_browser.py, whose browser tests are flaky/failing on main too (one failed before this change).

Follow-ups filed: per-page lock-out and the JSON-file record store into caplinks (steps 3, reviewer's note); dedup of the limiters is moot (heed.security already adapts enlace.ratelimit).