[samgbafa]

[global.encryption_network] named_keys_v1 (env TINYCLOUD_ENCRYPTION_NETWORK__NAMED_KEYS_V1, default off) now controls whether the node serves named keys. With it off:

• Routes. The five key handlers (POST /encryption/networks/<network_id>/keys, the two GET …/keys/<key_path..> ranks, POST …/key-actions/block and …/unblock) are not mounted, so those paths answer 404 as any unmounted path does. The network routes (/encryption/networks, …/<network_id>, …/decrypt, …/revoke, the well-known record) are mounted either way.
• Delegation ingress. validate_with in tinycloud-core/src/models/delegation.rs refuses any delegation with a capability on a key or key prefix (Resource::is_named_key, using key_id::parse). It runs over all capabilities before the root-authority filter, so a delegation the key's owner signs is covered, for UCAN and CACAO alike. POST /delegate answers 401 named_keys_unavailable: named keys are not enabled on this node. The setting reaches core through SpaceDatabase::with_named_keys, threaded to transact and process_with the way delegated_sql_caveats is.
• Invocation. POST /invoke answers 403 with the same text for an invocation with a capability on a key or key prefix. Decrypt on a bare network is unchanged.

With it on, behavior is unchanged. The test fixture (KvSyncFixture::new_with) now sets named_keys_v1 = true, so the existing key tests run as before.

Tests:

• tinycloud-core: named_key_grants_are_refused_when_named_keys_are_off (owner and non-owner, key and prefix, bare network unaffected, on admits).
• routes::tests::encryption_keys: delegate_refuses_named_key_resources_when_named_keys_are_off (UCAN, owner-signed, key/prefix/mixed, nothing stored, bare network admitted), delegate_admits_named_key_resources_when_named_keys_are_on, invoke_refuses_named_key_resources_when_named_keys_are_off (key, prefix; bare network decrypt still 200).
• policy_v3::named_keys_gate_tests (booted through app_with_control, SQLite and PostgreSQL variants): the five key routes answer the same as an unmounted path while the network routes still answer; owner-signed key and prefix delegations refused for did:key (UCAN) and did:pkh (SIWE CACAO) owners.
• production_route_tests::named_key_routes_are_mounted_only_when_named_keys_are_on.
• /info listing without the feature is covered by the existing named_keys_feature_is_advertised_only_behind_its_gate.

Details: TC-1777

[samgbafa]

APPROVE: see TC-1777 (reviewed exact head 9248aa0)