Name the instance in the tab and the brand link

instance_name reached the home page heading only. Every other page still called the instance “Vole” in the tab and in the brand link’s accessible name, which is what a screen reader announces — the two places a reader always meets the name.

What changed

• InstanceName moved onto the shared Page, filled by w.page from instanceName(), so no page builds the chrome without it. The home page’s own copy of the field is gone in favour of the shared one.
• chrome.html reads it for the document title (Issues · Acme Forge) and the brand link’s aria-label (“Acme Forge home”).
• A page with no configured name still says Vole, and no path renders a bare separator or an empty label, because instanceName() never returns “”.
• Decision on prose: the status page’s “restart Vole” keeps the product name. It names the program serving the instance, not the organisation’s forge, and “restart Acme Forge” would tell an operator to restart the wrong thing. That is written down in docs/configuration.md beside instance_name.

A grep -rn 'Vole' server/web/templates/ leaves only that status-page sentence and the template’s own comment; every other occurrence was the two chrome strings and the wordmark image, which is unchanged.

Verification

• TestInstanceNameReachesThePageChrome checks the landing page, a repository page, its issues tab, and the not-found page for · Acme Forge</title> and aria-label="Acme Forge home", and that none of them still says Vole.
• TestChromeDoesNotDangleASeparatorWithoutAName checks the default instance and that no bare <title>· or empty label is rendered.
• ./vole workflow run verify passes.

Closes #238.