capsite/toybox: routing carries no secrets

The ingress no longer reads labels from a Toybox-Labels header. A header
was no place for the webkey pattern: browsers can't set one on a
WebSocket, and the pattern puts the secret in-band anyway. A page keeps
it in its fragment, reaches the vat by public labels, and sends it in
the body of a call, which the vat checks like a swissnum.

A request still reaches a vat only by naming every label of its mount.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

toybox/mounts-sql.js

@@ -37,8 +37,8 @@ export const UNMOUNT_LABELS = "DELETE FROM mount_label WHERE vat = ?1";
  * the vat has. A mount with no labels matches any request.
  *
  * Stricter than Flower's match (no conflict): an ingress client holds no
- * constrained handle, so a label it omits must not match, or a secret
- * label would protect nothing.
+ * constrained handle that supplies labels for it, so a request reaches a
+ * vat only by naming every label of its mount.
  */
 export const LOOKUP = `
 	SELECT m.vat, m.labels FROM mount m JOIN (