fix(acp): preserve canonical host on private relay dial

[RossHartmann]

Summary

• keep WebSocket DNS/TCP routing on the configured private relay URI
• override only the WebSocket Host header from BUZZ_CANONICAL_RELAY_URL
• fail closed for invalid schemes or credential-bearing canonical URLs
• document the private-AKS/canonical-community deployment contract

Validation

• cargo fmt --all -- --check
• cargo test -p buzz-acp websocket_request --lib (5 passed)
• cargo test -p buzz-acp canonical_relay --lib (2 passed)
• cargo test -p buzz-acp --lib (634 passed; 9 unrelated Windows timing/process tests failed; Linux CI is the authoritative full gate)

Production defect

The AKS service accepted the private WebSocket upgrade only when Host was explicitly chat.kiingo.com. The prior connect_async(string) request sent Host: buzz:3000 and received HTTP 404, leaving the production listener in CrashLoopBackOff.