p2: digest with in-sift FIFO, SQLite caches, Honcho context, recover

Dixie is capped (max_inflight 2, queue_depth 8, queue_wait 20s) and
never queued on llama-server. Streaming chat, thinking off, 45s
fallback to clean. Digest and chunk-embedding caches are
content-addressed SQLite (Honcho context is not cached). Recover
uses the guarded Fetcher. guardian-star is refused in code.

internal/api/api_test.go

@@ -138,12 +138,21 @@ func TestSkipTLSVerificationIgnored(t *testing.T) {
 	}
 }
 
-func TestP2Rejected(t *testing.T) {
-	s, key := setupAPI(t, nil)
-	rec := postJSON(t, s, "/v1/fetch", key, map[string]any{"url": "http://example.com/", "mode": "digest"})
-	if rec.Code != 400 || !strings.Contains(rec.Body.String(), "P2") {
+func TestDigestFallbackWhenUnset(t *testing.T) {
+	g := &guard.Guard{AllowPrefixes: []netip.Prefix{netip.MustParsePrefix("127.0.0.0/8")}}
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "text/html")
+		_, _ = w.Write([]byte("<html><body><p>hello</p></body></html>"))
+	}))
+	defer ts.Close()
+	s, key := setupAPI(t, g)
+	rec := postJSON(t, s, "/v1/fetch", key, map[string]any{"url": ts.URL, "mode": "digest", "question": "what"})
+	if rec.Code != 200 {
 		t.Fatalf("%d %s", rec.Code, rec.Body.String())
 	}
+	if !strings.Contains(rec.Body.String(), "fallback") {
+		t.Fatalf("want fallback: %s", rec.Body.String())
+	}
 }
 
 func TestNever502(t *testing.T) {