v0.28.0 — proxy proof

Adds proxy proof: an opt-in gate letting a worker refuse any request that did not arrive through a trusted proxy.

The proxy mints a per-request HMAC-SHA256 over a timestamp, a nonce and the worker's own identifier, keyed by a secret shared only with that worker. Unlike a forwarded assertion about what happened at a TLS terminator, a proof cannot be produced by someone who merely reaches the worker directly — without the secret there is nothing to replay.

• docs/proxy-proof-spec.md is the normative cross-language contract.
• http/_proof.py — mint/verify, per-(proxy, origin) secret derivation, and the off/allow/require gate.
• http/_replay.py — nonce cache bounded by capacity as well as TTL.
• require_all() composes a precondition with a credential as an AND; chain_authenticate now rejects a PreconditionGate at construction, since chaining is first-success-wins and would make the gate bypassable.
• serve_http() gains authenticate= and token_key=.
• Conformance: TestProxyProof (fixture-gated) and TestProxyProofOffMode (ungated).

Also fixes TestHealth::test_health_does_not_require_auth, which asserted 401 against a path that does not exist and so proved nothing about auth.