Create a caller-local deny receipt

Notarize a caller's own local deny (e.g. spend_policy_denied). This is not a TWZRD wash verdict. Domain TWZRD:REFUSE_RECEIPT_V0; same Ed25519 v2 key as V6, different domain. Replay of the same natural key returns the same signed object for 90 days; after that a remint gets a new issued_at_unix and a new leaf. Requires X-Twzrd-Caller matching body.caller_id for the legacy format (202). Alternatively submit challenge_hash, issued_at_unix, resource, reason, payer_pubkey, signature for a free caller-signed declaration (200 logged, receipt_id, witness_signature). No caller header or payment required for this format. Ed25519 base58 signature over UTF-8 TWZRD:SIGNED_REFUSAL_V1 + LF + compact, sorted-key, ensure_ascii JSON of all five non-signature fields. issued_at_unix must be within 300s of server time. Optionally include quoted_price: this selects TWZRD:SIGNED_REFUSAL_V2 and signs all six non-signature fields, including the complete quote object. The witness receipt adds ingested_at_unix, the server ingestion time, bound into the witness leaf and distinct from the caller-signed issued_at_unix. Reasons and challenge provenance are caller claims. Invalid or stale signature returns 422 INVALID_REFUSAL_SIGNATURE.