web: a failed form action's reason rides a one-shot cookie, not the URL !219

Action handlers redirected back with ?e=<message>, so the reason survived a reload, landed in history and bookmarks, and every page that could show one read the query string.

setFlash queues the message in a short-lived HttpOnly, SameSite=Lax cookie on the redirect and takeFlash reads and clears it where the page renders; eight writers and eight readers converted. The merge request form keeps its prefill in the query and the account page keeps ?m= for its success note. The web e2e tests that post a form and expect the reason on the page run here with a cookie-jar client, which is how a browser behaves.

Stacked on !218; no code dependency.

Closes #119