Gateway: enforce caller authority and opaque app documents - #197

The gateway checks its configured Host, request origin and caller authority before reading private bodies. Runtime keeps Carrier bootstrap private unless the host enables its existing public publisher projection. Assistant launches are refused on Home routes. App and shell documents have opaque origins and gateway-only connections; Documents escapes hostile Markdown fields.

Anonymous passkey begin returns an empty credential list. Challenge pools and real-peer begin limits remain bounded. Authorized step-up selects only its original credential. Older security keys recover through a local operator hint: the CLI reads existing metadata, Home selects one ID in the browser, and the existing gateway verifies the proof. The same principal, root and role are preserved. Home clears the hint after each attempt, cancel and page exit.

Direct Chat gives a same-window Open Home link and starts neither WASM nor private API requests before Home launch. Signed Chat retains its existing startup. The historical CHAT-02 guest-admission prerequisite remains open; this change proves direct-entry recovery.

Validation:

• 2264 server library cases passed locally. Seven native-provider cases lacked local fixture binaries; final Linux CI supplies them and passes the full workspace, both actual-browser journeys and all eight required checks. Run 36950212069 is green on candidate 678ae6b1.
• Five metadata-reader tests and the identity privacy regression pass. Catalog revalidation, gateway shutdown and authorized step-up pass with the configured front-door authority.
• Both actual gateway browser fixtures pass: content/CID/app isolation, foreign localhost and DNS-rebinding refusal, Chat recovery, nonresident-key recovery, preserved account authority, and invalid, replayed, wrong-RP and revoked proof refusal.
• Home recovery/switch smokes, Chat startup/layout smokes, hostile Markdown cases, Clippy, formatting and entropy gates pass. Current develop was integrated with a normal merge.
• The initial boundary diff passed two independent source review rounds. Focused corrections received direct source review and the listed regression proof. The PR is ready with green CI and irzhywau requested for the final candidate.

Refs #167 and the merged scope from #185. Depends on #188; its candidate acfe57f remains an ancestor. Target: develop. Source and fixture proof is recorded here; installed product and manual UX claims remain outside this evidence. Human approval and integrated dependencies gate merge.