feat(infra): full-surface integration suite + docs sync + publish prep

Full-surface integration suite (tests/full_surface.rs, mcp feature):
- one HttpAdapter over real TCP (ProtocolHandler::handle path) serving
  gateway endpoints, /openapi.json, /mcp, and the WS channels session
- gateway: search/schema/call/subscribe/batch/publish presence,
  envelope shapes, error fidelity end-to-end
- from_openapi import -> Internal-by-default invisible from the wire ->
  External facade composes it via env.invoke -> upstream HTTP API
  called end-to-end (ADR-015 composition model exercised)
- to_openapi 6-path doc validated against openapiv3 over the wire
- to_mcp: MCP client connects to /mcp on the served adapter, lists the
  4 gateway tools, search returns ACL-filtered ops (Sub excluded)

Production fix: the WS upgrade route was reserved but never wired into
HttpAdapter's router (the ws-upgrade-session tests built their own
router). Now wired with ws_bearer_auth (401 without a resolvable
token) around ws_upgrade_handler.

Docs sync: all 28 'Port notes' sections/blockquotes stripped from
ported ADRs/specs; OQ-01/OQ-02 statuses corrected to resolved in
overview.md, websocket.md, and the README table (open-questions.md was
already current).

Publish prep: cargo publish --dry-run --allow-dirty succeeds;
cargo doc --no-deps warning-free (ADR link targets fixed); feature
combinations (default / test-support / mcp / wss / all) compile
warning-free under clippy -D warnings.

Verified: cargo test (182 lib default), --all-features (227 lib + 29
integration), clippy -D warnings x3 feature sets, fmt, doc,
publish --dry-run.

docs/architecture/decisions/010-alpn-router-and-endpoint.md

@@ -301,28 +301,3 @@ multiplexing, not listener transports.
 This also means shutdown is single-owner: the endpoint owns all its
 accept loops (quinn, iroh, TCP+TLS); one `shutdown()` stops them all.
 The multi-owner shutdown coordination problem (OQ-61) does not arise.
-
-## Port notes
-
-- This ADR is endpoint-internal to alkcall/alknet; ported because alkhttp
-  consumes its dispatch model (HttpAdapter registration, stealth/decoy
-  mapping, static ALPN registration). The alknet `AlknetEndpoint` struct in
-  the sketches is generically renamed `Endpoint` — the type lives in
-  alkcall's lineage, not in alkhttp.
-- Stealth-mode phrasing retargeted: "the `alknet/http` handler can serve a
-  decoy website" → "the HTTP handler can serve a decoy website", with a
-  consequence clause noting that in alkhttp this is the `HttpAdapter`'s
-  decoy surface.
-- QUIC-overload phrasing made transport-agnostic in the two places that
-  describe HttpAdapter mechanics: Amendment 1's "calls `accept_bi` once
-  (yielded by the single stream)" now reads "runs hyper over a
-  bidirectional stream (BiStream) yielded by `Connection::accept_bi()`".
-  The endpoint/iroh/quinn mechanics sections are untouched (they describe
-  alkcall/alknet-side reality).
-- ADR-065, ADR-083, ADR-027, ADR-044 references: ADR-044 is linked as
-  `decisions/044-defer-webtransport-browsers-use-websocket.md`-equivalent
-  (ported by other agents under the same number); ADR-065, ADR-083, and
-  ADR-027 are alkcall-internal, so referenced textually. h3/WebTransport
-  mentions that imply an alkhttp deliverable are marked out of scope in
-  alkhttp (ADR-069).
-- Mono-repo reference paths annotated as alknet mono-repo paths.