chore: release core 0.7.47, server 0.8.59, cli 0.10.51 and five more

[vivek7405]

Clears the whole release backlog. Every tracked package carries unreleased
user-facing work, so this ships all eight rather than a slice.

Package	From	To	Notes
@webjsdev/core	0.7.46	0.7.47	1 breaking
@webjsdev/server	0.8.58	0.8.59	2 breaking
@webjsdev/cli	0.10.50	0.10.51
@webjsdev/mcp	0.1.10	0.1.11	registry metadata only
@webjsdev/ui	0.3.10	0.3.11	1 breaking
@webjsdev/intellisense	0.5.4	0.5.5	registry metadata only
webjs (VS Code)	0.2.3	0.2.4	ships via vsce/ovsx, npm: false
webjs.nvim	0.2.3	0.2.4	ships via the subtree, npm: false

The headline

The bound-form write path (#1155, #1207). A form binds its action directly,
<form action=${importedAction}>, with formaction=${importedAction} on a
submitter when one form's buttons run different actions. It works with JS off,
and with JS the client router posts the same body to the same url and applies
the response in place. Every near-miss throws rather than emitting a form that
posts nowhere. This replaces the page action export.

Three breaking changes

Each closes a hole rather than moving an API, and each carries a migration note
in its changelog entry.

• The server HTML cache is keyed by origin (fix!: key the HTML cache by origin and centralize proxy trust #1237). A page opting in with
  export const revalidate could be poisoned through X-Forwarded-Host, which
  neither Cloudflare nor Railway strips. Callers of revalidatePath from a
  background job that serves no request of its own must now pass an absolute
  url.
• WEBJS_NO_TRUST_PROXY=1 overrides rateLimit({ trustProxy: true })
  (fix!: make WEBJS_NO_TRUST_PROXY override rateLimit trustProxy #1272). clientIp was the one forwarded-header reader the kill switch did
  not reach. An app setting both now buckets every visitor behind the proxy
  onto one key, which was always a misconfiguration and is now a visible one.
• @webjsdev/ui drops project detection (feat!: scope @webjsdev/ui to WebJs apps, drop project detection #1235). detectProject and
  defaultsForProject are removed from the published @webjsdev/ui/utils
  specifier with no shim.

Publish ordering and the core range

packages/server's declared @webjsdev/core range moves from ^0.7.46 to
^0.7.47. dev.js and the action dispatcher now import FORM_ACTION_FIELD,
FORM_ACTION_ID_KEY, and setFormActionResolver statically, and no published
core before 0.7.47 carries them, so the old range would let npm install a pair
that dies at module load. The release PR is the only place that bump is legal.

changelog/core/0.7.47.md holds the earliest date: of the batch, so the
publish loop ships core first and a failure there stops everything after it.

Curation

The generated notes were edited before committing, per the flow in
framework-dev.md:

• Both server breaking entries and the core one carry hand-written migration
  notes; the generator only excerpts the first lines of a commit message.
• The form-binding epic's review commits are folded into the feature they
  hardened rather than listed as eleven separate entries.
• changelog/ui/0.3.11.md is trimmed to the published surface. The generator
  attributes commits from the nested packages/ui/packages/website sub-app,
  which is not published; commit_count is corrected to match.
• Test-harness and repo-hygiene commits (the browser nav guard, the jspm
  fixture, the dist symlink removal) are dropped from the public notes.

Verification

• test/packaging/changelog-editor-packages.test.mjs and the four release
  repo-health suites: 36 pass.
• packages/editors/nvim/test/vendor-sync.test.mjs: 3 pass. The intellisense
  bump was re-vendored in the same commit, as that guard requires.
• website server suite (which renders /changelog): 443 pass. Browser suite:
  84 pass.
• The lockfile diff is only the eight versions plus the core range.