Make server lockdown configuration an upper bound in HTTP mode

[SamMorrowDrums]

Describe the bug

In HTTP mode, lockdown is active only when both server configuration and a request header enable it. This allows a request to opt out even when an operator started the server with lockdown enabled. Align activation semantics with other server-side restrictions, or explicitly redesign and document the intended authority model.

Affected version

Current main as of 2026-08-19.

Steps to reproduce the behavior

1. Start the HTTP server with lockdown enabled.
2. Send a request without the lockdown header.
3. Observe that request-scoped lockdown is disabled.

Expected vs actual behavior

Expected: operator configuration defines the maximum capability available to requests; request metadata can tighten restrictions but cannot relax them.

Actual: omitting the request header disables lockdown for that request.

Logs

N/A