feat(infra): full-surface integration suite + docs sync + publish prep

Full-surface integration suite (tests/full_surface.rs, mcp feature):
- one HttpAdapter over real TCP (ProtocolHandler::handle path) serving
  gateway endpoints, /openapi.json, /mcp, and the WS channels session
- gateway: search/schema/call/subscribe/batch/publish presence,
  envelope shapes, error fidelity end-to-end
- from_openapi import -> Internal-by-default invisible from the wire ->
  External facade composes it via env.invoke -> upstream HTTP API
  called end-to-end (ADR-015 composition model exercised)
- to_openapi 6-path doc validated against openapiv3 over the wire
- to_mcp: MCP client connects to /mcp on the served adapter, lists the
  4 gateway tools, search returns ACL-filtered ops (Sub excluded)

Production fix: the WS upgrade route was reserved but never wired into
HttpAdapter's router (the ws-upgrade-session tests built their own
router). Now wired with ws_bearer_auth (401 without a resolvable
token) around ws_upgrade_handler.

Docs sync: all 28 'Port notes' sections/blockquotes stripped from
ported ADRs/specs; OQ-01/OQ-02 statuses corrected to resolved in
overview.md, websocket.md, and the README table (open-questions.md was
already current).

Publish prep: cargo publish --dry-run --allow-dirty succeeds;
cargo doc --no-deps warning-free (ADR link targets fixed); feature
combinations (default / test-support / mcp / wss / all) compile
warning-free under clippy -D warnings.

Verified: cargo test (182 lib default), --all-features (227 lib + 29
integration), clippy -D warnings x3 feature sets, fmt, doc,
publish --dry-run.

docs/architecture/decisions/004-auth-as-shared-core.md

@@ -76,16 +76,3 @@ alkvault stays standalone. It does not depend on the core crate or `IdentityProv
 - [ADR-003](003-crate-decomposition.md): Crate decomposition
 - ADR-005: irpc as call protocol foundation
 - The previous architecture had equivalent decisions in ADR-023 (unified auth) and ADR-029 (identity as core type), which are archived in the reference implementation at `/workspace/@alkdev/alknet-main/`.
-
-## Port notes
-
-- ADR-011 (AuthContext immutability) and the `IdentityProvider` internals are
-  alkcall-internal concerns; referenced textually without links.
-- The `WebTransportAdapter` row and the WebTransport negative consequence are
-  retained as historical decision content; in alkhttp the browser path is
-  WebSocket (ADR-048) and h3/WebTransport is out of scope in alkhttp
-  (ADR-069, alknet-side).
-- Crate renames: "alknet-core" → "the shared core (now vendored in alkcall)",
-  "alknet-vault"/"alknet-secret" → alkvault. (The source alternated between
-  the "alknet-secret" and "alknet-vault" names for the same crate in the
-  Consequences and Decision sections; normalized to alkvault.)