Hosted-share metadata a daemon reads on `nerdit link refresh`

Publish the hosted base domain. Unauthenticated, static, cacheable.

No session, no node, no rate limiter of its own: the answer is the same for every caller and is already public in DNS and in the wildcard certificate, so there is nothing here for a caller to be authorized for. A pre-P26 daemon never asks; a pre-P26 cloud answers 404, which the daemon maps to its own link.refresh_unsupported — so the one thing this route must never do is exist and answer something else.