docs(pusher): document v2 onion delegation and legacy ping defaults

- Correct WELIST_ALLOW_LEGACY_PING: legacy pings are accepted by default,
  the flag only disables them.
- Describe onion delegation: v2-only inclusion, service-side host
  normalization, strict expiry check, deployment order and rollback.
- Warn that disabled delegation rejects onion pings when SSL_KEY_PATH is
  the dedicated ping key.
- Document certificate lifetime and revocation limits, offline master
  key requirements, helper --days bounds, and a delegation verification
  checklist.
- Fix the bal-pusher.sh comment about the service-side defaults.

bal-pusher.sh

@@ -30,8 +30,8 @@ export WELIST_SKIP_URL_VALIDATION=true
 # Local development uses the legacy v1 signature, verified by the service
 # against GET /.pub_key.pem: a localhost URL cannot use DNSSEC key discovery.
 # v2 requires a public DNS hostname (or a v3 onion URL) with a published key.
-# The WeTime service must run with WELIST_ALLOW_LEGACY_PING=true and, for
-# loopback addresses, WELIST_ALLOW_LOCALHOST_PING=true.
+# The WeTime service accepts legacy pings by default; for loopback addresses it
+# also needs WELIST_ALLOW_LOCALHOST_PING=true.
 export WELIST_PING_SIG_VERSION=1
 export BAL_SERVER_URL="http://127.0.0.1:9133"
 export SSL_KEY_PATH="$WORKING_DIR/private_key.pem"