capsite/toybox: egress through Flower-style switchboard handles

The switchboard now serves a Cap'n Web Handle on each of its sockets:
public (no loopback or private addresses) and local. A socket's labels
are fixed in config, so holding the socket's fd is holding that handle;
constrain(labels) returns a narrower one, as Flower's Constrain returns
a narrower fd. Labels only accumulate: a missing key matches anything,
and a key both sides set must agree (labels.js, shared by both).

The switchboard enforces the labels; toybox's Egress no longer checks
URLs itself. It opens a session to its one switchboard socket, constrains
the handle to the vat's grant, and forwards through it; a WebSocket
crosses the session as a pair of message streams. A vat narrows its own
grant with env.egress.constrain().

Grants are now labels as JSON. One stored before, a bare host[:port],
reads as {host, port}.

pnpm start and the systemd units give toybox the public handle; the
switchboard unit binds the local one in its own 0700 runtime directory.
The tests give their toybox the local handle to reach an echo server,
and check that a toybox holding only the public one never reaches it.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

toybox/switchboard.capnp

@@ -1,26 +1,34 @@
-# switchboard: toybox's only way out. A forward proxy (HTTP and WebSocket)
-# that toybox's Egress gateway reaches over a socket handed in with -S/-s.
+# switchboard: toybox's only way out, after Flower's switchboard.
 #
-# The network service is the switchboard's outer fence; under systemd,
-# IPAddressAllow=/IPAddressDeny= narrow it further (see systemd/).
+# Each socket is a handle with fixed labels: a WebSocket upgrade starts a
+# Cap'n Web session whose main object is that handle (see switchboard.js).
+# Whoever starts workerd hands the sockets in (-S/-s), so whoever holds a
+# socket's fd holds that handle and no other.
 using Workerd = import "/workerd/workerd.capnp";
 
 const config :Workerd.Config = (
   services = [
     (name = "main", worker = .switchboard),
-    (name = "internet", network = (allow = ["public", "local"], tlsOptions = (trustBrowserCas = true))),
+    (name = "nowhere", network = (allow = [])),
+    (name = "public-net", network = (allow = ["public"], tlsOptions = (trustBrowserCas = true))),
+    (name = "local-net", network = (allow = ["local"], tlsOptions = (trustBrowserCas = true))),
   ],
   sockets = [
-    # proxy style: the request line carries the full URL, scheme included
-    (name = "http", http = (style = proxy), service = "main"),
+    (name = "public", http = (), service = (name = "main", props = (json = "{\"network\":\"public\"}"))),
+    (name = "local", http = (), service = (name = "main", props = (json = "{\"network\":\"local\"}"))),
   ],
 );
 
 const switchboard :Workerd.Worker = (
   compatibilityDate = "2026-10-01",
-  modules = [(name = "switchboard.js", esModule = embed "switchboard.js")],
-  durableObjectNamespaces = [(className = "Switchboard", uniqueKey = "toybox-switchboard")],
-  durableObjectStorage = (inMemory = void),
-  bindings = [(name = "BOARD", durableObjectNamespace = "Switchboard")],
-  globalOutbound = "internet",
+  modules = [
+    (name = "switchboard.js", esModule = embed "switchboard.js"),
+    (name = "labels.js", esModule = embed "labels.js"),
+    (name = "capnweb", esModule = embed "node_modules/capnweb/dist/index-workers.js"),
+  ],
+  bindings = [
+    (name = "PUBLIC", service = "public-net"),
+    (name = "LOCAL", service = "local-net"),
+  ],
+  globalOutbound = "nowhere",
 );