fix(ledger): emit LF-v2 #package-name references for --template filters

[srikanth-bitdynamics]

Problem

BuildTemplateFilters put the user's package selector straight into TemplateId.PackageId, but against a Daml-LF-v2 / Splice 0.6.x participant that fails in every documented form (verified live on instance demo, app-user participant):

Input	Participant response
Splice.Amulet:Amulet (2-part)	Daml-LF Package ID is empty
<hex-id>:Splice.Amulet:Amulet	expected a package name (this participant is package-name-scoped)
splice-amulet:Splice.Amulet:Amulet (bare name)	expected a package name
#splice-amulet:Splice.Amulet:Amulet	✅ works

Only the LF-v2 #-prefixed package-name reference resolves — but the code and its own doc comment claimed the bare forms were package-name matches.

Fix

• packageRef normalisation (internal/canton/ledger/filter.go): a bare pkg-name:Module:Entity becomes #pkg-name (participant resolves it to the highest vetted version); a concrete 64-hex id stays an exact pin; an already-#-prefixed value passes through. Applied at the single PackageId assignment.
• Shared across surfaces: the ledger package backs both the CLI (contracts/tx) and the Web UI Explorer handlers, so both get the fix from one change.
• Docs/help: --template flag help (all sites + the ls long description), the UI 400 hint, the parse-error message, and docs/explorer.md now show #pkg-name:Module:Entity — quoted, since a bare leading # is a shell comment.
• Secondary UX wart: --template without --party fell back to the any-party wildcard and PermissionDenied on Splice's default user-id tokens. resolveDefaultParties (CLI) and the transactions handler (UI) now resolve the JWT's own parties in that path too, applying the template per party — mirroring the flag-less default. The now-dead templates param was dropped from resolveDefaultParties.

Note: the bare 2-part Module:Entity form still emits an empty PackageId (it has no name to reference) and remains non-functional on LF-v2 — docs/help steer users to the #pkg-name form.

Tests

• New internal/canton/ledger/filter_test.go table test: 2-part name-only → "", 3-part name → #name, 3-part #name → unchanged, 3-part hex → exact pin, plus isHexPackageID edges.
• New UI boundary test pinning template-only → resolves JWT parties → FiltersByParty with #-normalised template attached per party.
• Updated existing assertions that expected the raw package name.

go build ./..., go vet, gofmt, and go test ./... all pass.