hnsr: retain named-service and web checkpoint

[denuoweb]

Purpose

This fork-side stacked draft preserves the named-service and bounded web checkpoint that was removed from upstream hsd handshake-org#960 when that PR was narrowed to unnamed HNS_NODE_V1 rendezvous.

Review boundary

• base: the exact node-rendezvous branch submitted in net: add experimental HNS node rendezvous and relay handshake-org/hsd#960
• delta: HNS root-key authorization, service-key authorization, endpoint delegation, named routes, stable origin derivation, and bounded HNS_WEB_V1 transport
• status: retained research checkpoint, not an upstream merge request

Named-service authorization and browser/web semantics still need to be separated before any upstream submission. No permanent wire assignments are requested.

Program relationship: handshake-org/HIPs#76 (comment)