feat(infra): full-surface integration suite + docs sync + publish prep

Full-surface integration suite (tests/full_surface.rs, mcp feature):
- one HttpAdapter over real TCP (ProtocolHandler::handle path) serving
  gateway endpoints, /openapi.json, /mcp, and the WS channels session
- gateway: search/schema/call/subscribe/batch/publish presence,
  envelope shapes, error fidelity end-to-end
- from_openapi import -> Internal-by-default invisible from the wire ->
  External facade composes it via env.invoke -> upstream HTTP API
  called end-to-end (ADR-015 composition model exercised)
- to_openapi 6-path doc validated against openapiv3 over the wire
- to_mcp: MCP client connects to /mcp on the served adapter, lists the
  4 gateway tools, search returns ACL-filtered ops (Sub excluded)

Production fix: the WS upgrade route was reserved but never wired into
HttpAdapter's router (the ws-upgrade-session tests built their own
router). Now wired with ws_bearer_auth (401 without a resolvable
token) around ws_upgrade_handler.

Docs sync: all 28 'Port notes' sections/blockquotes stripped from
ported ADRs/specs; OQ-01/OQ-02 statuses corrected to resolved in
overview.md, websocket.md, and the README table (open-questions.md was
already current).

Publish prep: cargo publish --dry-run --allow-dirty succeeds;
cargo doc --no-deps warning-free (ADR link targets fixed); feature
combinations (default / test-support / mcp / wss / all) compile
warning-free under clippy -D warnings.

Verified: cargo test (182 lib default), --all-features (227 lib + 29
integration), clippy -D warnings x3 feature sets, fmt, doc,
publish --dry-run.

docs/architecture/decisions/037-mcp-stdio-transport-exclusion.md

@@ -180,25 +180,3 @@ wants it, they build it themselves and own the security model.
   streamable HTTP MCP client (the `from_mcp` pattern)
 - `docs/architecture/http-mcp.md` — this crate's spec that implements
   `from_mcp`/`to_mcp`
-
-## Port notes
-
-- Renames: "alknet-http" → alkhttp throughout (crate name, security
-  posture, feature-flag and threat-model references).
-- alknet ADR-025 (vault local-only dispatch) is cited textually: it is
-  not ported to alkhttp or alkcall; the vault decision record remains in
-  the alknet mono-repo. ADR-014/015/022 are ported to this crate under
-  the same numbers and linked.
-- The `client-and-adapters.md` citation became a textual "the alkcall
-  crate's `client-and-adapters.md`" reference (no relative link; the
-  document lives in alkcall's docs/architecture/).
-- `crates/http/http-mcp.md` → `docs/architecture/http-mcp.md` (this
-  crate's docs/architecture/). The alknet mono-repo research-doc path
-  (`docs/research/alknet-http/phase-0-findings.md`) is kept and labeled
-  as a mono-repo doc.
-- MCP server/client terminology untouched (inherent MCP directionality).
-- No frontmatter in the source; status kept as Proposed.
-- No decision content changed — the streamable-HTTP-only decision, the
-  stdio exclusion rationale, the bridge posture, the feature-gate shape,
-  and the consequences/assumptions are verbatim from the alknet ADR
-  modulo the renames logged above.