fix: heartbeat must refresh capabilities, not just timestamps

fix: accept both bare-origin and /v1 base_url conventions

THOX mesh controller: registry + router for ephemeral nodes

initial commit