webapp: mint form servable by a proxying worker

wrangler's multi-config dev binds aux workers but doesn't serve their
HTTP, so diigo-cache relays webapp's own mint form:

- WebAppFactory gains fetch(): the HTTP surface over the binding
- GET /form?render=1 leaves the form action as a placeholder the proxy
  points at its relay; ?title= sets the page title
- a dedicated cookie field (sugar for the cookie header; must agree
  with the JSON if both are given)

Generated-by: opencode (GLM)

webapp/README.md

@@ -3,19 +3,21 @@
 DO-backed fluent web client factory: site-agnostic. Deploy once; instances
 are attenuated handles whose **ids are bearer capabilities** — anyone
 holding the id string can drive the instance; nobody without it can.
-TODO: this proxy-page flow (see diigo-dump README) vs running webapp as
-the primary worker (`wrangler dev -c ../webapp/wrangler.jsonc -c ../diigo-dump/wrangler.jsonc`)
+TODO: this proxy-page flow (see diigo-cache README) vs running webapp as
+the primary worker (`wrangler dev -c ../webapp/wrangler.jsonc -c ../diigo-cache/wrangler.jsonc`)
 so its own port serves the mint form directly; reconsider when the UI
 grows past a form or two.
 
 ## HTTP surface
 
-- `GET /` — the mint form. Prefill via query string: `?url=…&headers=<urlencoded JSON>&msPerCall=…`; secret header keys (cookie, authorization, proxy-authorization) render **blank** — paste them at mint time; never echoed back.
+- `GET /` — the mint form. Prefill via query string: `?url=…&headers=<urlencoded JSON>&msPerCall=…&title=…`; secret header keys (cookie, authorization, proxy-authorization) render **blank** — paste them at mint time; never echoed back. A dedicated `cookie` field is sugar for the `cookie` header (if the JSON also has one, they must agree).
+- `GET /form?render=1&…` — the same form for a proxying worker (diigo-cache's `/_connect`): the action is left as an `ACTION` placeholder for the proxy to point at its own relay.
 - `POST /` — mint. Form-encoded (that page) or JSON `{url, headers, msPerCall}` (service-style). Responds `{id}` (and `x-webapp-id`). The id is *not* logged: possession is authority.
 - `POST /at/<id>` — drive an instance by capability: JSON `{path?, query?, method?, body?}` → the fluent chain → `{status, text}` (or `{error}`; messages carry no header/param values).
 
 ## RPC surface (same-account workers; binding `entrypoint: "WebAppFactory"`)
 
+- `fetch(request)` — the HTTP surface above, over the binding
 - `newWebApp({url, headers?, msPerCall?})` → `{id, app}` — the fluent stub;
   promise pipelining makes a whole `pathjoin().query().get()` chain a
   single round trip
@@ -24,8 +26,9 @@ grows past a form or two.
 ## Run
 
     npx wrangler dev   # → its own ready line (usually :8787 with the
-                       # two-config diigo-dump run; standalone, :8788)
+                       # two-config diigo-cache run; standalone, :8788)
 
-Status: typechecks; mint + drive not yet exercised end-to-end (needs the
-combined dev run; see ../capsite-checklist.md — it is the single
-source for run/connect/deploy instructions).
+Status: mint + drive exercised end-to-end in the combined dev run
+(through diigo-cache's create flow, 2026-10-07); not yet deployed. See
+../capsite-checklist.md — the single source for run/connect/deploy
+instructions.