Routes: scope network — res/res_json/res_header without network; outbound fetch needs explicit host-scoped grant #165

Follow-up from #163 review (Motoko). Routes currently always keep unscoped network, so a route with no fs grant can fetch its own /admin or internal/metadata services. Make response forms work without network and require explicit host-scoped grants for outbound fetch. Document the gap until fixed. Blocks any live-model run that serves routes.