capsite/toybox: vats have ids, not names; ingress by mount

createVat (POST / on the admin socket) makes a vat with newUniqueId and
returns its id, which addresses it only there. A vat is reachable only
where it is mounted: ?mount=<labels> on each start, as ?egress= is
granted; absent means none.

The ingress reads a request's labels from its query string, plus a
Toybox-Labels header for secret ones (a URL ends up in logs and
Referers). It routes to the vat whose mount labels the request carries,
every one: stricter than Flower's no-conflict match, since an ingress
client holds no constrained handle and a label it omits must not match.
Registration keeps Flower's rule, so a mount must conflict with every
other and no request can carry two. The app keeps the whole path and
sees its connection labels in Toybox-Connection-Labels.

A vat from before ids lives at idFromName(name). PUT /by-name/<name>
reaches it on the admin socket; it stays unreachable from outside until
mounted.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

toybox/config.capnp

@@ -15,9 +15,9 @@ const config :Workerd.Config = (
     (name = "state", disk = (path = "state", writable = true)),
   ],
   sockets = [
-    # reach a running vat by name
+    # the ingress: reach the vat mounted at a request's labels
     (name = "http", http = (), service = (name = "main", entrypoint = "Public")),
-    # install code into a vat and (re)start it
+    # create vats, install code, grant egress and ingress
     (name = "admin", http = (), service = (name = "main", entrypoint = "Admin")),
   ],
 );
@@ -29,10 +29,14 @@ const supervisor :Workerd.Worker = (
     (name = "labels.js", esModule = embed "labels.js"),
     (name = "capnweb", esModule = embed "node_modules/capnweb/dist/index-workers.js"),
   ],
-  durableObjectNamespaces = [(className = "Vat", uniqueKey = "toybox-vat", enableSql = true)],
+  durableObjectNamespaces = [
+    (className = "Vat", uniqueKey = "toybox-vat", enableSql = true),
+    (className = "Directory", uniqueKey = "toybox-directory", enableSql = true),
+  ],
   durableObjectStorage = (localDisk = "state"),
   bindings = [
     (name = "VATS", durableObjectNamespace = "Vat"),
+    (name = "DIRECTORY", durableObjectNamespace = "Directory"),
     (name = "LOADER", workerLoader = ()),
     (name = "SWITCHBOARD", service = "switchboard"),
   ],