feat(infra): full-surface integration suite + docs sync + publish prep

Full-surface integration suite (tests/full_surface.rs, mcp feature):
- one HttpAdapter over real TCP (ProtocolHandler::handle path) serving
  gateway endpoints, /openapi.json, /mcp, and the WS channels session
- gateway: search/schema/call/subscribe/batch/publish presence,
  envelope shapes, error fidelity end-to-end
- from_openapi import -> Internal-by-default invisible from the wire ->
  External facade composes it via env.invoke -> upstream HTTP API
  called end-to-end (ADR-015 composition model exercised)
- to_openapi 6-path doc validated against openapiv3 over the wire
- to_mcp: MCP client connects to /mcp on the served adapter, lists the
  4 gateway tools, search returns ACL-filtered ops (Sub excluded)

Production fix: the WS upgrade route was reserved but never wired into
HttpAdapter's router (the ws-upgrade-session tests built their own
router). Now wired with ws_bearer_auth (401 without a resolvable
token) around ws_upgrade_handler.

Docs sync: all 28 'Port notes' sections/blockquotes stripped from
ported ADRs/specs; OQ-01/OQ-02 statuses corrected to resolved in
overview.md, websocket.md, and the README table (open-questions.md was
already current).

Publish prep: cargo publish --dry-run --allow-dirty succeeds;
cargo doc --no-deps warning-free (ADR link targets fixed); feature
combinations (default / test-support / mcp / wss / all) compile
warning-free under clippy -D warnings.

Verified: cargo test (182 lib default), --all-features (227 lib + 29
integration), clippy -D warnings x3 feature sets, fmt, doc,
publish --dry-run.

docs/architecture/decisions/039-http-server-and-client-host-colocated.md

@@ -156,25 +156,3 @@ concerns that make splitting them counterproductive:
   gate
 - `overview.md` — the crate overview (the inline rationale
   for this decision is replaced by a pointer to this ADR)
-
-## Port notes
-
-- Renames: alknet-http → alkhttp; alknet-call → alkcall; the
-  hypothetical split-crate names (`alknet-http-server` +
-  `alknet-http-client`) genericized ("an HTTP-server crate + an
-  HTTP-client crate").
-- The Context line "for `h2`/`http/1.1`/`h3`" was corrected to
-  "for `h2`/`http/1.1`" — h3 is out of scope in alkhttp (ADR-069);
-  alkhttp serves HTTP/1.1 + HTTP/2 on the standard ALPNs.
-- The `to_openapi` route description "whose paths mirror the
-  `/{service}/{op}` HTTP routes the `HttpAdapter` serves (ADR-036)"
-  was corrected: the direct-call `/{service}/{op}` surface was removed
-  by ADR-047, so the doc now says the paths mirror the gateway routes,
-  with ADR-036's mapping noted as superseded by ADR-047 (linked as
-  `decisions/047-remove-direct-call-http-surface.md`, ported by another
-  agent under the same number).
-- ADR-014/017/023/036/037 are being ported with the same numbers by
-  other agents and are linked as `decisions/NNN-<slug>.md` (alknet
-  slugs). The mono-repo link `../crates/call/client-and-adapters.md`
-  became a textual "alkcall crate docs" reference;
-  `crates/http/overview.md` → `overview.md` in `docs/architecture/`.