Preserve canonical Host on private ACP HTTP relay calls

[RossHartmann]

Summary

• keep private relay HTTP requests on the configured internal service URL
• override only the HTTP Host header with the validated canonical relay authority
• use the same fail-closed canonical URL scheme/credential/host validation for WebSocket and HTTP paths
• preserve NIP-98 signing against the canonical URL

Production evidence

Final Kiingo deployment run 30597856133 deployed the intended immutable images and proved the WebSocket fix from #15: all 12 ACP slots initialized and connected to ws://buzz:3000. The listener then exited at first channel discovery with:

channel discovery error: HTTP error: POST /query returned HTTP 404 Not Found

The relay is host-bound to chat.kiingo.com; the HTTP bridge still sent the private service authority (buzz:3000) even though NIP-98 was correctly signed for the canonical URL. This change separates HTTP transport routing from community authority just as #15 already does for the WebSocket upgrade.

Validation

• cargo fmt --all -- --check — pass
• cargo test -p buzz-acp canonical_host -- --nocapture — 2 passed, 0 failed
• cargo clippy -p buzz-acp --all-targets -- -D warnings — pass
• git diff --check — pass

Commit is DCO-signed. Hooks were bypassed only after the repository-required scoped Rust preflight above; no unrelated broad build/test lane was run.