capsite/toybox: ingress is a capability; a hello-world web vat

E(vatAdmin).makeIngress(labels) reserves a mount and returns an ingress;
whoever holds it serves requests carrying those labels by calling
E(ingress).serve(handler). A vat gets one in its params, like any other
remote object; nothing in a vat's module is an entrypoint. A request
reaches the handler as passable data (method, path, labels, body), and
the response comes back as data (status, headers, body). The handler is
a live reference for now: after a restart its mount answers 503.

vats/hello.js serves hello, world; pnpm hello creates it on a running
toybox (client.js is the Node OCapN client, shared with the tests).

pnpm start and pnpm switchboard never ran: systemd-socket-activate wants
absolute paths for unix sockets.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

toybox/vats/hello.js

@@ -0,0 +1,12 @@
+/** Hello, world, served through the `ingress` it was created with. */
+export const buildRootObject = ({ E, Far }, { ingress }) => {
+	const handler = Far("helloHandler", {
+		handle: ({ path }) => ({
+			status: 200,
+			headers: { "content-type": "text/html; charset=utf-8" },
+			body: `<!doctype html><title>hello</title><h1>Hello, world</h1><p>from a toybox vat, at ${path}</p>\n`,
+		}),
+	});
+	E(ingress).serve(handler);
+	return Far("helloRoot", {});
+};