issue 1859: mark the page after an act by a one-shot cookie, not its address

Review round 2 F3 (ADR 0517 §3, 1858/AC5): acted=1 stayed in the address, so a reload, a restored tab or a
bookmark of it recorded no page opened or opened. An act's 303 (and a mode chosen) now sets mail_acted for
10 seconds, HttpOnly and SameSite=Strict, Secure but on 127.0.0.1; the next list or pane it reaches records
nothing and clears it; the address carries no marker. The local run keeps the browser's other cookies.

modules/mesh-mail-web/cmd/mail-page-dev/main.go

@@ -88,7 +88,14 @@ func start(addr string, now time.Time) (*localRun, error) {
 	}
 	page := web.NewServer(host, &web.Auth{Sessions: sessions, Pending: web.NewPendingAuths(clock)}, newBundle(w))
 	signedIn := http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		// Every cookie the browser carries but the session's own (the act's, web.ActedCookie, among them).
+		kept := req.Cookies()
 		req.Header.Del("Cookie")
+		for _, c := range kept {
+			if c.Name != web.SessionCookie {
+				req.AddCookie(c)
+			}
+		}
 		req.AddCookie(&http.Cookie{Name: web.SessionCookie, Value: id})
 		page.ServeHTTP(rw, req)
 	})