dev.atfs.describeServer

Report what this instance can accept and how to reach it over libp2p, before a client hands it a single byte. Sits beside dev.atfs.server rather than under dev.atfs.repo.* with the file methods, because it describes the instance itself, not a repo. Deliberately a separate call from the did:web identity document: a DID document is an identity record, not a capability advertisement, and mixing the two would constrain both — this one is free to grow new capability fields without touching identity resolution. Public and unauthenticated: everything it reports is either already public elsewhere (serviceDid, the instance's own hard size ceiling) or is freely offered to any libp2p peer that connects anyway (a peer ID and its addresses are exchanged on every connection's identify handshake) — there is nothing here an allowlist would protect.