feat(infra): full-surface integration suite + docs sync + publish prep

Full-surface integration suite (tests/full_surface.rs, mcp feature):
- one HttpAdapter over real TCP (ProtocolHandler::handle path) serving
  gateway endpoints, /openapi.json, /mcp, and the WS channels session
- gateway: search/schema/call/subscribe/batch/publish presence,
  envelope shapes, error fidelity end-to-end
- from_openapi import -> Internal-by-default invisible from the wire ->
  External facade composes it via env.invoke -> upstream HTTP API
  called end-to-end (ADR-015 composition model exercised)
- to_openapi 6-path doc validated against openapiv3 over the wire
- to_mcp: MCP client connects to /mcp on the served adapter, lists the
  4 gateway tools, search returns ACL-filtered ops (Sub excluded)

Production fix: the WS upgrade route was reserved but never wired into
HttpAdapter's router (the ws-upgrade-session tests built their own
router). Now wired with ws_bearer_auth (401 without a resolvable
token) around ws_upgrade_handler.

Docs sync: all 28 'Port notes' sections/blockquotes stripped from
ported ADRs/specs; OQ-01/OQ-02 statuses corrected to resolved in
overview.md, websocket.md, and the README table (open-questions.md was
already current).

Publish prep: cargo publish --dry-run --allow-dirty succeeds;
cargo doc --no-deps warning-free (ADR link targets fixed); feature
combinations (default / test-support / mcp / wss / all) compile
warning-free under clippy -D warnings.

Verified: cargo test (182 lib default), --all-features (227 lib + 29
integration), clippy -D warnings x3 feature sets, fmt, doc,
publish --dry-run.

docs/architecture/decisions/045-to-openapi-gateway-spec-versioning.md

@@ -197,35 +197,3 @@ published contract and the one this ADR governs.
 - `http-adapters.md` (in this crate's `docs/architecture/`) — the spec
   that emits `info.version` (alknet original:
   `crates/http/http-adapters.md`)
-
-## Port notes
-
-- Renames: "alknet" → alkhttp where the system/node being described is
-  meant (including the original's "no alknet-specific detection
-  mechanism", "no `x-alknet-version` extension", "an alknet-specific
-  mechanism" — now alkhttp-specific / `x-alkhttp-version` semantics);
-  the protocol-foundation crate is alkcall.
-- **Gateway endpoint count / version bump**: the original decision text
-  (5 endpoints) is preserved verbatim as history; alkhttp's `/publish`
-  addition (ADR-068) is noted as an explicit alkhttp note in Decision §1
-  and in the References — per this ADR's own rules it is an additive
-  minor bump of the gateway contract; the versioning rationale is
-  unchanged.
-- Producer/consumer terminology: the original body contained no
-  call-protocol server/client role framing; the client roles mentioned
-  (clients built against the doc, clients caching schemas) are
-  HTTP/OpenAPI inherent-directionality roles and keep their names.
-- Cross-reference remappings (verified alknet→alkcall ADR mapping):
-  alknet ADR-009 (one-way door framework) → alkcall ADR-032, cited
-  textually. ADR-017/023 are ported to this crate under the same
-  numbers and linked; their alkcall record numbers are noted alongside
-  (017→alkcall ADR-022, 023→alkcall ADR-016).
-- OQ-39 is an alknet OQ-tracker item, cited textually; it is resolved by
-  this ADR, which this crate ports under the same number.
-- Spec-document links converted per alkhttp conventions:
-  `crates/http/http-adapters.md` → `http-adapters.md` in this crate's
-  `docs/architecture/`.
-- No decision content changed — the semver rules, bump-on-shape-change
-  rule, major-version detection, the additive-projection carve-out,
-  consequences, and assumptions are verbatim from the alknet ADR modulo
-  the adaptations above.