B1: only the Phobos server may call a person's keyring #52

Part of #46. Owner decision 2026-10-14 (via Jarvis, recorded on #46): per-person keyrings run on Cloudflare Containers (B1): keyring's Go binary unchanged, one container per person, controlled by one Durable Object (DO) per person. File mode for the owner's Mac stays the default and unchanged; everything here is opt-in. No Cloudflare account changes or spending without the owner's approval.

Depends on #45 (instance mode: encrypted state, admin API).

Problem

On the Mac, a role token works only from allow_sources. At Cloudflare, a leaked role token would work from anywhere on the internet.

Change

• Callers must prove they are the Phobos router, not only hold a role token: Cloudflare Access service token checked by the Worker, or a second secret held by the router (never by the sandbox), checked by the Worker or DO before forwarding and/or by the keyring in container mode.
• The sandbox's agent never holds this secret; the router adds it when forwarding the agent's call.
• Decide where the check lives (Worker, DO or keyring) and test the refusal path.

Acceptance

• A request with a valid role token but without the router proof is refused before it reaches the API (test).
• The router proof never appears in the audit log or upstream requests.