fix: harden token delivery, session revokes, app identity and fs scoping (#4229)

- relay sign-in popups take the opener origin from the referrer only
- session revokes read the primary, batch per user, and tombstone caches in every region
- wisp relay tokens bound to the minting session; verify rechecks the account
- hosted origins keep app identity with the site owner; deleted app uids recorded in deleted_apps
- subdomain cache tombstoned on delete, update, reclaim and app/account cascades
- email lookups require an exact address match after the SQL lookup
- workers deploy only from files the deployer owns
- share_app_data:false enforced at ACL time, plus copy/move/rename/share/recursive listing
- kv remove returns no value without read; kv:expire op grant usable
- fs errors name the entry instead of the owner's path
- shared-by-me drops rows a delegate no longer has authority over
- private apps can't move index_url onto another user's origin
- GUI: default apps saved and launched by uid; save picker accepts only copy/move; permission dialog waits for focus; Publish as Worker hidden on others' files

src/docs/src/Email/sendTransactional.md

@@ -37,7 +37,7 @@ A plain-text body. Shorthand for `text`; use the options form for anything else.
 - `html` (String) - HTML body. An inline image is shown with `<img src="cid:...">` — see `cid` under `attachments`.
 - `cc` (String | Array) - Carbon-copy recipient(s).
 - `bcc` (String | Array) - Blind-copy recipient(s). At most **10** recipients across `to`, `cc` and `bcc`.
-- `replyTo` (String) - Where replies go. Defaults to the confirmed account email of the app's owner (the worker's owner when the worker runs under no app). While that address is unconfirmed, the message goes out without a Reply-To and replies bounce.
+- `replyTo` (String) - Where replies go. Defaults to the confirmed account email of the worker's owner. While that address is unconfirmed, the message goes out without a Reply-To and replies bounce.
 - `emailAccessToken` (String) - A worker's auth token — inside a worker, `me.puter.authToken`. Required when the caller is not itself a worker. The caller stays the billed and rate-limited identity.
 - `attachments` (Array) - Up to **10** attachments, **25 MB** in total. Each is an object:
   - `filename` (String) - Required with `content`; defaults to the file's name for a `path`/`uid` attachment.
@@ -76,7 +76,9 @@ A recipient at a Puter address, `<username>@puter.email`, is a Puter user, and t
 
 Mail goes out from a Puter-controlled address minted for your app — `<app-name>-no-reply@apps.puter.email`, labelled with your app's title — so you never configure a sending domain, and a recipient's filters can tell your app's mail from every other app's. You cannot set `from`: the address is what proves the mail came through Puter, and the app is where the name and identity come from.
 
-Recipients who hit reply reach `replyTo`. Left unset, that is the confirmed account email of the app's owner. Set it explicitly to route replies to a shared inbox instead.
+The app is the one the worker runs under, or else the one the caller is signed in through. It's used only when the worker's owner also owns that app. Otherwise the mail goes out from `no-reply@apps.puter.email` with no app name.
+
+Recipients who hit reply reach `replyTo`. Left unset, that is the confirmed account email of the worker's owner. Set it explicitly to route replies to a shared inbox instead.
 
 ## Recipient protections
 

src/docs/src/KV/remove.md

@@ -26,7 +26,7 @@ Paths support dot notation, array indexes at any level (`[0]`, `items[0]`, or `s
 
 ## Return value
 
-Returns a `Promise` that resolves to the updated value stored at `key`. An expired key resolves to `null`.
+Returns a `Promise` that resolves to the updated value stored at `key`. An expired key resolves to `null`. A call on another app's data with `optConfig.appUuid` also resolves to `null` when your app may delete that app's entries but not read them.
 
 ## Errors