capsite/toybox: routing carries no secrets

The ingress no longer reads labels from a Toybox-Labels header. A header
was no place for the webkey pattern: browsers can't set one on a
WebSocket, and the pattern puts the secret in-band anyway. A page keeps
it in its fragment, reaches the vat by public labels, and sends it in
the body of a call, which the vat checks like a swissnum.

A request still reaches a vat only by naming every label of its mount.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

toybox/test/vat.test.js

@@ -171,13 +171,16 @@ test("mounts that could both match a request are refused", async () => {
 	assert.match((await admin.create(src, { mount: { vat: "y", n: "2" } })).vat, /^[0-9a-f]{64}$/);
 });
 
-test("a secret label: in a header, not the URL; omitting it doesn't match", async () => {
-	const secret = "k".repeat(43);
-	await admin.create(await app("show-labels.js"), { mount: { vat: "safe", key: secret } });
-	assert.equal((await pub.get("/?vat=safe")).status, 404);
-	assert.equal((await pub.get("/?vat=safe&key=wrong")).status, 404);
-	const got = await pub.get("/?vat=safe", { "Toybox-Labels": JSON.stringify({ key: secret }) });
-	assert.equal(got.status, 200);
+test("a request reaches a vat only by naming every label of its mount", async () => {
+	await admin.create(await app("show-labels.js"), { mount: { vat: "both", flavor: "plain" } });
+	assert.equal((await pub.get("/?vat=both")).status, 404);
+	assert.equal((await pub.get("/?vat=both&flavor=fancy")).status, 404);
+	assert.equal((await pub.get("/?vat=both&flavor=plain")).status, 200);
+});
+
+test("routing reads no labels from headers", async () => {
+	const got = await pub.get("/?vat=both", { "Toybox-Labels": JSON.stringify({ flavor: "plain" }) });
+	assert.equal(got.status, 404);
 });
 
 test("code, state, and mount survive a restart", async () => {