capsite/webapp: the cookie's store is the owner's, apart from the instance

Letting the instance id rotate the cookie let its holder (the cache, or
whoever learns the id) swap in another account's session, which the
owner's logout would not stop. Now mint makes two things: the instance,
and a header store (lib's MapStoreDo, shaped ("cookie", { keyShape:
"cookie", valueShape: M.string() })). The instance id is authority to
use the cookie; the store id, for the account owner, to rotate (PUT
/store/<storeId>/cookie, or WebAppFactory.store) or revoke (DELETE).
Instances read the store's read-only view at every send, via init's new
headerStore.

This replaces the in-instance cookie store and its migration: instances
minted earlier keep their cookie in init.headers, untouched, and simply
cannot rotate. The MapStoreDo class arrives as wrangler migration v2
(additive).

Generated-by: Claude Opus 5.5

capsite-checklist.md

@@ -110,9 +110,10 @@ narrative.
   - [ ] **6. Cookie expiry**: when diigo's session ends, head refreshes
         fail; the public page keeps serving what's stored (say so on the
         page, don't fail silently). Rotation is in place, keeping the
-        webapp id (so the cache's wiring and ids hold): `POST
-        /at/<id>/cookie` with the new cookie (webapp README, "The cookie
-        store"). Still open: a rotate form in diigo-cache's UI.
+        webapp id (so the cache's wiring and ids hold), by the store id
+        minted alongside it and kept by the account owner: `PUT
+        /store/<storeId>/cookie` (webapp README, "The header store").
+        Still open: a rotate form in diigo-cache's UI.
   - [ ] **7. bib sync #195**: repeat the pattern for the next
         read-access need (webapp mints for any origin; the cache's
         item shape is diigo-specific): [the zotero goal tree](zotero-checklist.md).