feat(infra): full-surface integration suite + docs sync + publish prep

Full-surface integration suite (tests/full_surface.rs, mcp feature):
- one HttpAdapter over real TCP (ProtocolHandler::handle path) serving
  gateway endpoints, /openapi.json, /mcp, and the WS channels session
- gateway: search/schema/call/subscribe/batch/publish presence,
  envelope shapes, error fidelity end-to-end
- from_openapi import -> Internal-by-default invisible from the wire ->
  External facade composes it via env.invoke -> upstream HTTP API
  called end-to-end (ADR-015 composition model exercised)
- to_openapi 6-path doc validated against openapiv3 over the wire
- to_mcp: MCP client connects to /mcp on the served adapter, lists the
  4 gateway tools, search returns ACL-filtered ops (Sub excluded)

Production fix: the WS upgrade route was reserved but never wired into
HttpAdapter's router (the ws-upgrade-session tests built their own
router). Now wired with ws_bearer_auth (401 without a resolvable
token) around ws_upgrade_handler.

Docs sync: all 28 'Port notes' sections/blockquotes stripped from
ported ADRs/specs; OQ-01/OQ-02 statuses corrected to resolved in
overview.md, websocket.md, and the README table (open-questions.md was
already current).

Publish prep: cargo publish --dry-run --allow-dirty succeeds;
cargo doc --no-deps warning-free (ADR link targets fixed); feature
combinations (default / test-support / mcp / wss / all) compile
warning-free under clippy -D warnings.

Verified: cargo test (182 lib default), --all-features (227 lib + 29
integration), clippy -D warnings x3 feature sets, fmt, doc,
publish --dry-run.

docs/architecture/decisions/034-outgoing-only-x509-and-three-peer-roles.md

@@ -6,12 +6,12 @@
 
 Accepted (resolves OQ-37)
 
-> **Port note (emphasis):** This port emphasizes **§4 — browsers are not
-> peers** — because that clause governs alkhttp's browser-facing surface
-> (the WebSocket path, alkhttp ADR-044/ADR-048). The X.509/TLS machinery
-> this ADR discusses (server cert verifiers, `TlsIdentity`, WebPKI
-> verification, fingerprint pinning) is **an alknet concern**: alkhttp is
-> transport-coupling-free and owns no TLS configuration or verifier
+**Relevance for this crate:** §4 — browsers are not peers — governs
+alkhttp's browser-facing surface (the WebSocket path, alkhttp
+ADR-044/ADR-048). The X.509/TLS machinery this ADR discusses (server
+cert verifiers, `TlsIdentity`, WebPKI verification, fingerprint
+pinning) is **an alknet concern**: alkhttp is transport-coupling-free
+and owns no TLS configuration or verifier
 > selection. The X.509-relevant sections (§2, §3, §5) are retained for
 > provenance and marked accordingly; what alkhttp consumes is the peer-
 > model closure of §4 and the three-role vocabulary of §1.
@@ -270,12 +270,11 @@ clients.
 
 ### 5. WebTransport relay-as-proxy is a transport-only feature, scoped separately *(alknet concern)*
 
-> **Port note:** WebTransport is **not in alkhttp scope at all** — per
-> alkhttp ADR-069 it was removed from this crate entirely (it is an
-> alknet concern). This section is retained for provenance of the
-> *auth-model* point (the proxy is transport-only and does not change
-> identity resolution), which remains true regardless of where the
-> proxy lives.
+**WebTransport is not in alkhttp scope at all** — per alkhttp ADR-069
+it was removed from this crate entirely (it is an alknet concern). This
+section is retained for the *auth-model* point (the proxy is
+transport-only and does not change identity resolution), which remains
+true regardless of where the proxy lives.
 
 A **WebTransport proxy** that terminates the browser's WebTransport
 connection and proxies encrypted traffic to a hub's P2P endpoint
@@ -491,51 +490,3 @@ alknet/alkcall assembly-layer components, not alkhttp surface.)*
 - alkcall crate docs — `CallClient`/`ConnectionCredentials` dial path,
   verifier selection by `PeerEntry` presence; see the alkcall crate's
   own documentation for the client-and-adapters spec
-
-## Port notes
-
-- The call protocol core types are vendored in the **alkcall** crate
-  (old alknet-core + alknet-call merged). All type-level references are
-  re-cited to alkcall ADRs: peer-keyed overlay/`PeerCompositeEnv` is
-  alkcall ADR-024, `PeerEntry`/fingerprint normalization is alkcall
-  ADR-025, `CallClient`/adapter contract is alkcall ADR-022 (§7
-  credentials), `ConnectionCredentials` is alkcall ADR-012, Layer 2
-  registry layering is alkcall ADR-019, `from_call` as a manual free
-  function is alkcall ADR-028. The alknet ADR numbers that originally
-  carried these (ADR-029, ADR-030, ADR-017, ADR-024) are alknet numbers
-  and do not coincide with alkcall or alkhttp numbers; each citation
-  above names the owning crate explicitly.
-- `CallCredentials` → `ConnectionCredentials`: alkcall ADR-012 renamed
-  the credential struct when it decoupled dial from call; the ported
-  text uses the current name with the original alkcall ADR-022 §7
-  citation preserved.
-- `alknet/call` (the old ALPN string) → `alk/call` (alkcall ADR-004
-  `alk/` convention). Table and prose updated.
-- "alknet-http" → "alkhttp"; "alknet node"/"alknet peer" phrasing
-  generalized to "node"/"peer" where the sentence is about the protocol
-  model rather than the alknet binary.
-- §4 heading and prose originally said "over WebTransport"; the port
-  adds "(or HTTPS — and, per alkhttp ADR-044, over WebSocket)" and
-  attributes the served surface to alkhttp. WebTransport references are
-  marked as alknet concerns; in alkhttp, WebTransport is out of scope
-  entirely (alkhttp ADR-069), not deferred.
-- §2, §3, §5, and §6 are retained for provenance but annotated: TLS
-  verifier selection, fingerprint pinning, the iroh transport relay, and
-  the on-chain peer-store adapter are dial-layer/alknet concerns, not
-  alkhttp surface. §4 is the load-bearing clause for this crate and is
-  the emphasis of this port.
-- alknet OQ references (OQ-29, OQ-36, OQ-37, OQ-10, OQ-38) are alknet
-  open-questions records, not ported into alkhttp's OQ file; they are
-  cited textually as "alknet OQ-NN" (alkcall ADR-024 is cited for the
-  peer-graph model rather than alknet OQ-37's original resolution
-  context).
-- Reference links rewritten: `../../decisions/...` and
-  `../../crates/...` relative links replaced per alkhttp docs
-  conventions; links into the old call/core spec trees became textual
-  "alkcall crate docs" references. alknet ADR-027 is linked as a
-  sibling file because it is ported to alkhttp (same number and slug).
-- The original also cited `docs/research/alknet-http/phase-0-findings.md`
-  (DH-2) and iroh reference docs; these are alknet research artifacts
-  and are referenced textually only.
-- Original title preserved: "Outgoing-Only X.509 and the Three Peer
-  Roles".