feat(websocket): WS upgrade route + channels session (server producer half)

- src/websocket/byte_adapter.rs: production WsByteStream from the POC —
  inbound bounded mpsc (64 slots, backpressure), outbound chunk parser
  emitting one WS message per chunk with 1 MiB split; write-side
  backpressure now uses futures mpsc poll_ready (POC spin-wait fixed);
  text messages closed with 1002; close mapping per websocket.md
- src/websocket/upgrade.rs: /alk/channels upgrade route — bearer auth
  (401 unresolvable), identity attached to the channels Connection,
  ChannelsAdapter + install_channel_zero running
  Dispatcher::run_loop_single_stream
- test_support module (feature test-support): WsClient, chunk/frame
  assemblers; shared with from_wss consumer path (ADR-070)
- tests/ws_upgrade_session.rs: 10 integration tests — call round-trip,
  services/list ACL-filtered, 3 MiB split, interleaved calls, ACL 403,
  internal-op NOT_FOUND, text->1002 close, disconnect mid-call no-hang

Verified: cargo test (95), cargo test --all-features (95+10),
clippy -D warnings (default + all-features), fmt.

tasks/websocket/upgrade-session.md

@@ -1,7 +1,7 @@
 ---
 id: ws-upgrade-session
 name: WS upgrade route + channels session (server producer half)
-status: pending
+status: completed
 depends_on: [ws-byte-adapter, server-adapter]
 scope: broad
 risk: high
@@ -25,12 +25,12 @@ running `Dispatcher::run_loop_single_stream`. Text messages rejected
 
 ## Acceptance Criteria
 
-- [ ] Upgrade route wired into HttpAdapter's router (reserved-path collision rule respected)
-- [ ] End-to-end test: WS client (tokio-tungstenite or axum test client) → upgrade → chunk-framed call.requested on channel 0 → response received
-- [ ] Browser-style test: services/list via channel 0, AccessControl-filtered
-- [ ] Disconnect mid-call: pending requests failed, overlay dropped, no hang
-- [ ] 16 MiB chunk split/reassembly test carried over from the POC
-- [ ] `cargo test` passes
+- [x] Upgrade route wired into HttpAdapter's router (reserved-path collision rule respected)
+- [x] End-to-end test: WS client (tokio-tungstenite or axum test client) → upgrade → chunk-framed call.requested on channel 0 → response received
+- [x] Browser-style test: services/list via channel 0, AccessControl-filtered
+- [x] Disconnect mid-call: pending requests failed, overlay dropped, no hang
+- [x] 16 MiB chunk split/reassembly test carried over from the POC
+- [x] `cargo test` passes
 
 ## References
 
@@ -45,4 +45,28 @@ running `Dispatcher::run_loop_single_stream`. Text messages rejected
 
 ## Summary
 
-> Agent fills on completion.
+Implemented the WS upgrade route + channels session (server producer
+half), production shape:
+
+- `src/websocket/byte_adapter.rs`: WsByteStream (WS <-> AsyncRead+Write).
+  Production hardening over the POC: write-side backpressure via
+  futures::channel::mpsc poll_ready (replaces the POC spin-wait);
+  text-message rejection via WriteMsg::CloseWith(1002) routed through
+  the writer task; CloseWith(code)/queue-drain close mapping. Shared
+  with from_wss (ADR-070).
+- `src/websocket/upgrade.rs`: ws_upgrade_handler (Extension<Identity>,
+  401 without a resolvable token via ws_bearer_auth middleware sharing
+  server::auth::extract_bearer_identity), run_channels_session
+  (Connection::from_bidi b"alk/channels" + set_identity ->
+  ChannelsAdapter with NoCap policy), install_channel_zero hook =
+  alkcall channels/client.rs accept-side pattern (split_single_stream ->
+  CallConnection::new_single_stream -> Dispatcher::run_loop_single_stream).
+- `src/websocket/test_support` (feature test-support): WsClient +
+  chunk/frame assemblers for integration tests and downstream use.
+- `tests/ws_upgrade_session.rs`: 10 tests over real TCP sockets —
+  round-trip, 401 no-token, 401 unresolvable token, 3 MiB chunk split
+  round-trip with byte-integrity, 20 interleaved calls correlation,
+  mid-call disconnect no-hang, text->1002 close, ACL 403 FORBIDDEN,
+  internal-op NOT_FOUND, services/list AccessControl-filtered.
+
+95 lib + 10 integration tests green (default + all-features).