Require service handlers to declare a hint input #1

The subject a consumer passes is now explicitly a reference (at-uri, URL, DID); only string and blob go by value. Adds an optional subjectCid (strongRef with the URI) and a small fixed-shape, untrusted hint preview (dev.at-intent.defs#hint) carried in the JSON body of non-blob POSTs. Documents the rules in capability-spec, consumers and producers, reserves subjectCid/hint in the validator, and has the demo send a title hint.