refactor(gateway): delete dead accessors and FromRef impls (review 002 COV-13)

Coverage-confirmed dead code (every binary, zero hits):

- server/state.rs: drop FromRef<RouterState> impls for
  Arc<OperationRegistry> and Arc<dyn IdentityProvider> — no route
  extracts these types; the auth middleware receives the provider
  directly via from_fn_with_state
- gateway/dispatch.rs: drop identity_provider() and resolve_bearer()
  accessors; resolve_bearer's doc promised an auth hook the middleware
  never calls (spec/code drift). Wire-or-delete resolved to delete:
  bearer resolution lives in the middleware (SRV-11 single-resolve
  ordering), the dispatch spine only needs the per-call
  Option<Identity>. GatewayDispatch::new consequently takes the
  registry alone (GatewayState loses its unused identity_provider
  passthrough; dispatch.rs/to_mcp.rs tests simplified)
- websocket/upgrade.rs: drop FromRef<SessionState> for
  Arc<OperationRegistry> — no router carries SessionState as its state
  type; the inverse FromRef<Arc<OperationRegistry>> for SessionState
  (custom upgrade routes, integration tests) remains

Verification: ./scripts/verify.sh (352 passed), ./scripts/verify.sh
--all-features (466 passed), clippy -D warnings, fmt --check.

src/gateway/dispatch.rs

@@ -3,8 +3,9 @@
 //!
 //! Thin concrete struct (not a trait — the alknet research ruled out a
 //! trait with an associated output type). Holds `Arc<OperationRegistry>`
-//! and `Arc<dyn IdentityProvider>` and exposes a `resolve_bearer()` and
-//! `invoke()` method pair returning the neutral `ResponseEnvelope`. Each
+//! and exposes an `invoke()` family returning the neutral
+//! `ResponseEnvelope` — identity is supplied per-call, resolved upstream
+//! in the auth middleware. Each
 //! gateway maps the envelope to its own wire shape (`to_openapi` → HTTP
 //! `Response`, `to_mcp` → `CallToolResult`).
 //!
@@ -33,7 +34,7 @@ use std::collections::HashMap;
 use std::sync::Arc;
 use std::time::{Duration, Instant};
 
-use alkcall::core::auth::{AuthToken, Identity, IdentityProvider};
+use alkcall::core::auth::Identity;
 use alkcall::core::types::Capabilities;
 use alkcall::protocol::wire::{CallError, ResponseEnvelope};
 use alkcall::registry::context::{AbortPolicy, OperationContext, ScopedPeerEnv};
@@ -44,25 +45,19 @@ use serde_json::Value;
 
 const DEFAULT_TIMEOUT: Duration = Duration::from_secs(30);
 
-/// The shared dispatch spine: registry + identity provider, wired for
+/// The shared dispatch spine over the registry, invoking operations for
 /// the neutral `ResponseEnvelope` result shape both gateway projections
-/// map to their wire formats.
+/// map to their wire formats. Identity arrives per-call as
+/// `Option<Identity>` — bearer resolution happens upstream in the auth
+/// middleware, not here.
 pub struct GatewayDispatch {
     registry: Arc<OperationRegistry>,
-    identity_provider: Arc<dyn IdentityProvider>,
 }
 
 impl GatewayDispatch {
-    /// Assemble a dispatch spine over a registry and an identity
-    /// provider.
-    pub fn new(
-        registry: Arc<OperationRegistry>,
-        identity_provider: Arc<dyn IdentityProvider>,
-    ) -> Self {
-        Self {
-            registry,
-            identity_provider,
-        }
+    /// Assemble a dispatch spine over a registry.
+    pub fn new(registry: Arc<OperationRegistry>) -> Self {
+        Self { registry }
     }
 
     /// The registry operations resolve against.
@@ -70,16 +65,6 @@ impl GatewayDispatch {
         &self.registry
     }
 
-    /// The identity provider bearer tokens resolve against.
-    pub fn identity_provider(&self) -> &Arc<dyn IdentityProvider> {
-        &self.identity_provider
-    }
-
-    /// Resolve a bearer token to an identity (the auth-middleware hook).
-    pub fn resolve_bearer(&self, token: &AuthToken) -> Option<Identity> {
-        self.identity_provider.resolve_from_token(token)
-    }
-
     /// Invoke a Query/Mutation op under the 30 s gateway deadline; a
     /// hung handler surfaces as a `TIMEOUT` error envelope (504).
     pub async fn invoke(
@@ -221,33 +206,10 @@ mod tests {
     };
     use alkcall::registry::spec::{AccessControl, OperationSpec, OperationType, Visibility};
     use futures::StreamExt;
-    use std::sync::Mutex as StdMutex;
 
     // The tests below run against the module's real 30 s deadline; only
     // the elapsed-time bound (< 60 s, anti-flake) is asserted by hand.
 
-    struct StaticIdentityProvider {
-        tokens: StdMutex<HashMap<String, Identity>>,
-    }
-
-    impl StaticIdentityProvider {
-        fn new() -> Self {
-            Self {
-                tokens: StdMutex::new(HashMap::new()),
-            }
-        }
-    }
-
-    impl IdentityProvider for StaticIdentityProvider {
-        fn resolve_from_fingerprint(&self, _fp: &str) -> Option<Identity> {
-            None
-        }
-        fn resolve_from_token(&self, token: &AuthToken) -> Option<Identity> {
-            let token_str = String::from_utf8_lossy(&token.raw);
-            self.tokens.lock().unwrap().get(token_str.as_ref()).cloned()
-        }
-    }
-
     fn spec(name: &str, visibility: Visibility, op_type: OperationType) -> OperationSpec {
         OperationSpec::new(
             name,
@@ -280,8 +242,7 @@ mod tests {
 
     #[tokio::test]
     async fn invoke_external_op_round_trips() {
-        let dispatch =
-            GatewayDispatch::new(echo_registry(), Arc::new(StaticIdentityProvider::new()));
+        let dispatch = GatewayDispatch::new(echo_registry());
         let envelope = dispatch
             .invoke(None, "/echo/run", serde_json::json!({ "x": 1 }))
             .await;
@@ -290,8 +251,7 @@ mod tests {
 
     #[tokio::test]
     async fn invoke_unknown_op_returns_not_found() {
-        let dispatch =
-            GatewayDispatch::new(echo_registry(), Arc::new(StaticIdentityProvider::new()));
+        let dispatch = GatewayDispatch::new(echo_registry());
         let envelope = dispatch
             .invoke(None, "/missing/op", serde_json::json!({}))
             .await;
@@ -316,8 +276,7 @@ mod tests {
                 Capabilities::new(),
             ))
             .unwrap();
-        let dispatch =
-            GatewayDispatch::new(Arc::new(registry), Arc::new(StaticIdentityProvider::new()));
+        let dispatch = GatewayDispatch::new(Arc::new(registry));
         let envelope = dispatch
             .invoke(None, "/internal/op", serde_json::json!({}))
             .await;
@@ -345,8 +304,7 @@ mod tests {
                 Capabilities::new(),
             ))
             .unwrap();
-        let dispatch =
-            GatewayDispatch::new(Arc::new(registry), Arc::new(StaticIdentityProvider::new()));
+        let dispatch = GatewayDispatch::new(Arc::new(registry));
         let started = std::time::Instant::now();
         let envelope = dispatch
             .invoke(None, "/hung/op", serde_json::json!({}))
@@ -367,8 +325,7 @@ mod tests {
 
     #[tokio::test]
     async fn invoke_completes_within_the_deadline_for_a_fast_handler() {
-        let dispatch =
-            GatewayDispatch::new(echo_registry(), Arc::new(StaticIdentityProvider::new()));
+        let dispatch = GatewayDispatch::new(echo_registry());
         let envelope = dispatch
             .invoke(None, "/echo/run", serde_json::json!({}))
             .await;
@@ -394,8 +351,7 @@ mod tests {
                 Capabilities::new(),
             ))
             .unwrap();
-        let dispatch =
-            GatewayDispatch::new(Arc::new(registry), Arc::new(StaticIdentityProvider::new()));
+        let dispatch = GatewayDispatch::new(Arc::new(registry));
         let mut stream =
             dispatch.invoke_streaming(None, "/tick/stream", serde_json::json!({ "count": 3 }));
         let mut ticks = Vec::new();