refactor: move hashcash stamp from X-Hashcash header to JSON request body

Move the hashcash proof-of-work stamp from the X-Hashcash HTTP header
into the JSON request body as a 'hashcash' field on POST /api/v1/session.

Updated server handler, CLI client, SPA client, and documentation.

web/src/app.jsx

@@ -135,20 +135,22 @@ function LoginScreen({ onLogin }) {
     e.preventDefault();
     setError("");
     try {
-      const extraHeaders = {};
+      let hashcashStamp = "";
       if (hashcashBitsRef.current > 0) {
         setError("Computing proof-of-work...");
-        const stamp = await mintHashcash(
+        hashcashStamp = await mintHashcash(
           hashcashBitsRef.current,
           hashcashResourceRef.current,
         );
-        extraHeaders["X-Hashcash"] = stamp;
         setError("");
       }
+      const reqBody = { nick: nick.trim() };
+      if (hashcashStamp) {
+        reqBody.hashcash = hashcashStamp;
+      }
       const res = await api("/session", {
         method: "POST",
-        body: JSON.stringify({ nick: nick.trim() }),
-        headers: extraHeaders,
+        body: JSON.stringify(reqBody),
       });
       localStorage.setItem("neoirc_token", res.token);
       onLogin(res.nick);