Open an owned node's shared service through a one-time ticket

Mint a ticket bound to <service>--<slug>.<nodes_base_domain>.

The name is validated against the daemon's own service grammar before anything else, and a failure is the same 404 an unknown node gets: what is not a service name cannot be a hosted label, and answering anything more specific would describe this deployment's naming rules to whoever asked. Whether a service by that name exists, or is shared, is not asked here at all — the daemon re-reads its own share row on every stream and answers its byte-identical share.not_shared for a miss, so a ticket to nothing costs its holder one 404 and this route no knowledge it would otherwise have to keep in sync.