feat: Updated affected components on status page incidents

CLAUDE.md

@@ -480,6 +480,20 @@ fetched data (no DB calls inside it) is what makes the boundary testable
 without a database, which is the only thing standing between an editor adding
 a field to `PublicComponent` and that field being a hostname.
 
+**An incident may only name components the page already carries.**
+`services.checkAffectedOnPages` refuses an `affected_monitors` entry that no
+page in the incident's `page_ids` lists, and the editor offers only the saved
+page's components — labelled by their per-page display name, since that is the
+name the reader sees. Naming an arbitrary monitor would publish a machine the
+page deliberately does not, which is the same leak `assembleSnapshot`'s
+redaction boundary exists to prevent, reached from the authoring side instead
+of the read side. It is a separate pass rather than part of `validateIncident`
+because it reads the database and `validateIncident` is a pure function of the
+document. A component dropped from the page **after** an incident named it
+makes the next edit of that incident fail, deliberately: the editor renders the
+stale entry flagged and checked so it is one click from being dropped, and the
+alternative is a page quietly publishing a component it no longer has.
+
 Monitor-detected outages are **derived at read time, never copied**: each
 snapshot assembly reads recent `incidents` for the page's monitors and folds
 them into the timeline alongside the authored ones. There is no second