pss: HTTPS fallback for reverse direction (job_ack / job_deliver)

Bee 2.8's pushsync from homelab to prod consistently routes our trojan
chunks to neighbour ff7adaed instead of prod_bee at ff896a93, even with
both nodes directly peered. The chunk lands at a third-party node that
can't decrypt it, so the gateway never receives provider ack/deliver
envelopes and the chat times out.

Workaround: gateway advertises a clientReplyUrl in job_notify. Provider
POSTs the same signed envelopes there; gateway verifies the signature
(same trust check as the PSS subscription) and dispatches via the same
onEnvelope handler. PSS remains the fallback when no replyUrl is set
(non-hosted clients).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/t4t/lib/types.ts

@@ -36,6 +36,11 @@ export interface JobNotifyBody {
   clientPssPubKey: Hex
   /** Gateway's Bee overlay for PSS routing. */
   clientSwarmOverlay: Hex
+  /** Optional HTTPS URL the provider may POST ack/deliver envelopes to,
+   *  for clients (like the hosted gateway) where reverse-direction PSS
+   *  delivery isn't reliable. The provider trusts this because the
+   *  envelope is signed by the gateway's on-chain wallet. */
+  clientReplyUrl?: string
 }
 
 export interface JobAckBody {