Make WebFetch discovery cache-safe and self-describing

[Daily-AC]

Web clients were guessing device target formats, losing the state URL after owner approval, and receiving opaque fetch failures instead of API errors. A shared public discovery response also carried a live session ticket that third-party fetch caches could reuse across callers.

This change makes discovery static and credential-free, creates requests through independent nonce URLs, and adds an authenticated portal page that copies a fresh connection prompt. Authorized manifests now publish exact targets, input schemas, URL templates and continuation instructions. HTML GET errors remain readable while carrying their logical status; JSON retains normal HTTP error codes. Owner approval errors offer recovery without exposing another owner's grant, and logs record only server-generated IDs and fixed rejection categories.

Validation:

• Full Go race suite with real PostgreSQL passed.
• DeepSeek completed real discovery, pairing, execution and revocation checks against the isolated normal-policy fixture; ledger and output matched.
• Gemini created a real request and job when complete URLs were explicitly supplied; complete execution compatibility is not claimed.
• ChatGPT browser testing hit a platform Unusual activity block before an interface result.
• Portal copy generated distinct nonce URLs, and the bilingual documentation build passed with no broken links.

Relay/portal-only v0.9.1 update; v0.9.0 agents remain compatible and no new database migration is needed. New bootstrap clients consume start_url_template; existing session URLs keep their expiry and revocation behavior.