refactor(gateway): delete dead accessors and FromRef impls (review 002 COV-13)

Coverage-confirmed dead code (every binary, zero hits):

- server/state.rs: drop FromRef<RouterState> impls for
  Arc<OperationRegistry> and Arc<dyn IdentityProvider> — no route
  extracts these types; the auth middleware receives the provider
  directly via from_fn_with_state
- gateway/dispatch.rs: drop identity_provider() and resolve_bearer()
  accessors; resolve_bearer's doc promised an auth hook the middleware
  never calls (spec/code drift). Wire-or-delete resolved to delete:
  bearer resolution lives in the middleware (SRV-11 single-resolve
  ordering), the dispatch spine only needs the per-call
  Option<Identity>. GatewayDispatch::new consequently takes the
  registry alone (GatewayState loses its unused identity_provider
  passthrough; dispatch.rs/to_mcp.rs tests simplified)
- websocket/upgrade.rs: drop FromRef<SessionState> for
  Arc<OperationRegistry> — no router carries SessionState as its state
  type; the inverse FromRef<Arc<OperationRegistry>> for SessionState
  (custom upgrade routes, integration tests) remains

Verification: ./scripts/verify.sh (352 passed), ./scripts/verify.sh
--all-features (466 passed), clippy -D warnings, fmt --check.

src/server/adapter.rs

@@ -285,10 +285,7 @@ fn build_router(state: RouterState, extra_routes: Option<Router>) -> Router {
 
     #[cfg(feature = "mcp")]
     let mcp_router: Router<RouterState> = {
-        let dispatch = crate::gateway::GatewayDispatch::new(
-            Arc::clone(&state.registry),
-            Arc::clone(&state.identity_provider),
-        );
+        let dispatch = crate::gateway::GatewayDispatch::new(Arc::clone(&state.registry));
         Router::new()
             .nest_service(
                 "/mcp",