feat(infra): full-surface integration suite + docs sync + publish prep

Full-surface integration suite (tests/full_surface.rs, mcp feature):
- one HttpAdapter over real TCP (ProtocolHandler::handle path) serving
  gateway endpoints, /openapi.json, /mcp, and the WS channels session
- gateway: search/schema/call/subscribe/batch/publish presence,
  envelope shapes, error fidelity end-to-end
- from_openapi import -> Internal-by-default invisible from the wire ->
  External facade composes it via env.invoke -> upstream HTTP API
  called end-to-end (ADR-015 composition model exercised)
- to_openapi 6-path doc validated against openapiv3 over the wire
- to_mcp: MCP client connects to /mcp on the served adapter, lists the
  4 gateway tools, search returns ACL-filtered ops (Sub excluded)

Production fix: the WS upgrade route was reserved but never wired into
HttpAdapter's router (the ws-upgrade-session tests built their own
router). Now wired with ws_bearer_auth (401 without a resolvable
token) around ws_upgrade_handler.

Docs sync: all 28 'Port notes' sections/blockquotes stripped from
ported ADRs/specs; OQ-01/OQ-02 statuses corrected to resolved in
overview.md, websocket.md, and the README table (open-questions.md was
already current).

Publish prep: cargo publish --dry-run --allow-dirty succeeds;
cargo doc --no-deps warning-free (ADR link targets fixed); feature
combinations (default / test-support / mcp / wss / all) compile
warning-free under clippy -D warnings.

Verified: cargo test (182 lib default), --all-features (227 lib + 29
integration), clippy -D warnings x3 feature sets, fmt, doc,
publish --dry-run.

src/adapters/from_jsonschema.rs

@@ -8,7 +8,7 @@
 //! `scoped_env: None`, `Internal` by default — ADR-015/022). `Sub` op
 //! type → `HandlerKind::Stream` expecting `text/event-stream` (ADR-049).
 //!
-//! [ADR-066]: crate::docs
+//! [ADR-066]: https://docs.rs/alkhttp (docs/architecture/decisions)
 
 use std::sync::Arc;
 

src/adapters/from_openapi.rs

@@ -9,7 +9,7 @@
 //! default — ADR-015/022). Imported error codes are prefixed `HTTP_<status>`
 //! to avoid collision with the protocol-level codes (ADR-023).
 //!
-//! [ADR-051]: crate::docs
+//! [ADR-051]: https://docs.rs/alkhttp (docs/architecture/decisions)
 
 use std::sync::Arc;
 

src/adapters/from_wss.rs

@@ -28,7 +28,7 @@
 //! handler calls fail on write; reconnect policy is the assembly layer's
 //! job.
 //!
-//! [ADR-070]: crate::docs
+//! [ADR-070]: https://docs.rs/alkhttp (docs/architecture/decisions)
 
 use std::sync::Arc;
 

src/gateway/error.rs

@@ -6,7 +6,7 @@
 //! HTTP APIs are prefixed `HTTP_<status>` and map to their declared
 //! status.
 //!
-//! [ADR-023]: crate::docs
+//! [ADR-023]: https://docs.rs/alkhttp (docs/architecture/decisions)
 
 use alkcall::core::auth::Identity;
 use alkcall::protocol::wire::CallError;

src/server/adapter.rs

@@ -155,6 +155,18 @@ fn build_router(state: RouterState, extra_routes: Option<Router>) -> Router {
         .merge(crate::gateway::routes::gateway_router())
         .route("/openapi.json", get(openapi_json_handler))
         .route("/healthz", get(healthz))
+        // The WS upgrade route carries its own bearer middleware
+        // (`ws_bearer_auth` — 401 without a resolvable token, because a WS
+        // session without an identity cannot run AccessControl::check); the
+        // shared bearer_auth_middleware only stashes a permissive
+        // Option<Identity> for the gateway endpoints.
+        .route(
+            WS_UPGRADE_PATH,
+            get(crate::websocket::ws_upgrade_handler).route_layer(from_fn_with_state(
+                auth_state.clone(),
+                crate::websocket::ws_bearer_auth,
+            )),
+        )
         .route_layer(from_fn_with_state(
             auth_state.clone(),
             bearer_auth_middleware,

src/server/auth.rs

@@ -19,7 +19,7 @@
 //! `AccessControl` (the route handlers / `GatewayDispatch::invoke()` do)
 //! or map `CallError` codes to HTTP status (the error mapping does).
 //!
-//! [ADR-004]: crate::docs
+//! [ADR-004]: https://docs.rs/alkhttp (docs/architecture/decisions)
 
 use std::convert::Infallible;
 use std::sync::Arc;

src/server/decoy.rs

@@ -8,9 +8,9 @@
 //! decoy must not leak alk presence — no alk-specific headers, no alk
 //! error format.
 //!
-//! [ADR-010]: crate::docs
-//! [ADR-036]: crate::docs
-//! [ADR-046]: crate::docs
+//! [ADR-010]: https://docs.rs/alkhttp (docs/architecture/decisions)
+//! [ADR-036]: https://docs.rs/alkhttp (docs/architecture/decisions)
+//! [ADR-046]: https://docs.rs/alkhttp (docs/architecture/decisions)
 
 use std::path::{Component, Path, PathBuf};