Clean up Herald well-known routes and wallet configuration

[macterra]

Summary

• remove the writable PUT /.well-known/names/:name route from Herald so /.well-known/* stays read-only
• preserve authenticated name writes under /api/name
• make Herald's shared-Keymaster integration use ARCHON_HERALD_KEYMASTER_URL instead of the global ARCHON_KEYMASTER_URL
• allow standalone Herald wallet mode via ARCHON_HERALD_WALLET_PASSPHRASE
• clean up Herald wallet URL defaults and samples
• remove the leftover services/herald/server/sample.env and point docs at the root sample.env

Testing

• npm run build (services/herald/server)
• docker compose config