Delete the heartbeat; let iroh do the addressing

The daemon POSTed /api/daemon/heartbeat every 15 seconds carrying its endpoint
id, its relay url, and the resource ids it served. All three are gone.

iroh's presets::N0 — which both ends already use — installs a PkarrPublisher on
the daemon and a PkarrResolver on the viewer, and the resolver works in the
browser, over HTTPS to the n0 DNS server's /pkarr path. The daemon was already
publishing its own address and the browser could already resolve it. The
with_relay_url() in connection_to was handing iroh something it would have found
by itself.

Taking the three fields in turn:

  relay_url    redundant, as above.

  endpoint_id  the public half of the key at DEVSITE_HOME/identity. Identical on
               every run, so it is registered once when the daemon starts, via
               PUT /api/daemon.

  serving,     the online/offline dot, and a pre-flight refusal in
  last_seen    /api/capability. The refusal was never a security property: the
               daemon checks resource-in-local-config on every request anyway,
               so dropping the control-plane copy makes nothing more permissive.
               The dot was stale by up to 45 seconds, and M6 records it lying.

So presence is gone rather than reduced. A profile makes no claim about
reachability and clicking a service finds out. ViewerEndpoint::fetch now takes an
address — a bare endpoint id in the browser, resolved by iroh — and bounds the
attempt with CONNECT_TIMEOUT. "Offline" means we asked and nobody answered, which
is the only version of it that was ever true.

The cost, stated plainly: a dead daemon takes CONNECT_TIMEOUT to report instead
of being greyed out in advance. Everything else is upside. Steady-state writes go
to zero, so the database is read-mostly and a single SQLite connection behind one
mutex stops being the thing that bounds concurrent users. There is no timer on
the user's machine. And the control plane is out of the addressing path, which is
what it always claimed to be.

The authz tests keep passing an explicit relay. They are about what the daemon
enforces, not about how it was found, and routing them through a third-party
lookup would turn a denial into something that could also be a slow resolve. The
discovery path was verified in a real browser instead: a service opened with only
an endpoint id in the capability response, then the daemon was killed and the
timeout and its message were confirmed.

Migration 3 drops relay_url, serving and last_seen. SCHEMA is left alone, as the
append-only rule requires, so a fresh database creates those columns and then
drops them — and a database old enough to still hold a heartbeat's worth of data
keeps its daemon's identity across the change. There is a test for that.

68 tests.

commit

dffe6c6b379889be26aed1ed735804d514222af1

parent

6a8ca6bd7104fc41c58fa5e995e424cd66d79313

author

Dami <dami.etoile@gmail.com>