feat(websocket): WS upgrade route + channels session (server producer half)

- src/websocket/byte_adapter.rs: production WsByteStream from the POC —
  inbound bounded mpsc (64 slots, backpressure), outbound chunk parser
  emitting one WS message per chunk with 1 MiB split; write-side
  backpressure now uses futures mpsc poll_ready (POC spin-wait fixed);
  text messages closed with 1002; close mapping per websocket.md
- src/websocket/upgrade.rs: /alk/channels upgrade route — bearer auth
  (401 unresolvable), identity attached to the channels Connection,
  ChannelsAdapter + install_channel_zero running
  Dispatcher::run_loop_single_stream
- test_support module (feature test-support): WsClient, chunk/frame
  assemblers; shared with from_wss consumer path (ADR-070)
- tests/ws_upgrade_session.rs: 10 integration tests — call round-trip,
  services/list ACL-filtered, 3 MiB split, interleaved calls, ACL 403,
  internal-op NOT_FOUND, text->1002 close, disconnect mid-call no-hang

Verified: cargo test (95), cargo test --all-features (95+10),
clippy -D warnings (default + all-features), fmt.

src/websocket/mod.rs

@@ -1 +1,21 @@
+//! WebSocket subsystem: the browser bidirectional path
+//! ([ADR-067](../docs/architecture/decisions/067-websocket-carries-channels.md)).
+//!
+//! A WS session carries the **channels protocol**: the 8-byte chunk
+//! header multiplexes N logical channels over the WS binary message
+//! stream; channel 0 is pre-negotiated as `alk/call` and dispatched by
+//! the shared `Dispatcher`. The WS↔byte-stream adapter
+//! ([`byte_adapter`]) is the single seam between axum's WS and
+//! alkcall's byte-oriented channels machinery — shared with the
+//! `from_wss` consumer path ([ADR-070]).
 
+pub mod byte_adapter;
+pub mod upgrade;
+
+pub use byte_adapter::{
+    split_ws_to_bytes, WsByteStream, WsPumps, WS_MESSAGE_CAP, WS_PROTOCOL_ERROR,
+};
+pub use upgrade::{run_channels_session, ws_bearer_auth, ws_upgrade_handler};
+
+#[cfg(any(test, feature = "test-support"))]
+pub use upgrade::test_support::{frame_channel0_chunk, ChunkAssembler, FrameAssembler, WsClient};