docs(design): what the gateway signs for, CORS, and ENSv2

[xgreenx]

Stacked on #7 (design/ens-integration), so the diff is only what this adds. Companion to libid-org/libid-contracts#23, which pins the resolver side.

What this adds

• What the gateway signs for (under The backend): the resolver in the digest is the address the gateway is configured to serve, never the {sender} in the path. Step 6 of the work list now says resolver, not sender. {sender} is logged, not parsed strictly (viem lowercases it). One instance per resolver.
• CORS, on every response: why the browser fetches the gateway directly today, which headers, and that they belong in the binary rather than a proxy.
• Direct invocation, later: the condition under which a future deployment may announce ERC-7996 with the multicall feature, and that it is a new deployment.
• ENSv2 changes none of this (under Namespace): v2's DNSTLDResolver consults the v1 registry first and forwards to the resolver it finds, so the import and the resolver survive v2 unchanged; only .eth names have a migration.
• One sentence in The trust model and one in the testing note, pointing at the above.

Why

ENS's ResolverCaller (today's mainnet UniversalResolver and v2's DNSTLDResolver share it) reaches a resolver by one of two routes. Through the batch gateway (ENSIP-21) the original sender survives, so {sender} is our resolver. Directly, which ERC-7996 switches on (ENSIP-22), the universal resolver raises the OffchainLookup again under its own address, so {sender} becomes the universal resolver. The doc previously specified signing for sender, which is the reference offchain-resolver gateway's behaviour and fails on the second route. Signing for a configured address holds on both and costs one setting.

The mainnet universal resolver's batch gateway provider advertises ["https://ccip-v3.ens.xyz", "x-batch-gateway:true"]; viem prefers the local marker and runs the batch gateway in the page, so the gateway is fetched cross-origin from the wallet's site today, not only under ERC-7996.

References: ENSIP-21, ENSIP-22, ResolverCaller.sol, CCIPReader.sol, DNSTLDResolver.sol, viem localBatchGatewayRequest.ts.

Observed

Sepolia handles.link already has an owner and a HandleResolver (0xd46181CAb629AEDA48406b462656513821De6775, ERC-7996 not announced, URL http://127.0.0.1:8080/ens/{sender}/{data}.json). Mainnet has neither yet. No gateway exists in the org, so the CORS requirement lands here rather than as a code change.