docs: missing_docs sweep — 0 warnings + deny gate + publish-prep decisions (HY-02, HY-04, HY-11)

- document every public-API item across 18 files (openapi_spec model,
  HttpAuthScheme/HttpServiceConfig, HttpClientBuildError + SharedHttpClient
  accessors, RetryAfterMiddleware, GatewayDispatch, gateway error
  mapping, CallRequest/SchemaQuery/SubscribeStream, HttpAdapter +
  ALPNs + builders, decoy/healthz/state, WsSessions/WsPumps,
  from_openapi/from_jsonschema/from_mcp/from_wss/to_mcp, lib.rs module
  docs)
- enforcement: #![deny(missing_docs)] at crate root — stronger than CI
  rustdocflags (every build incl. cfg(test), where rustdoc misses the
  test-support module docs)
- HY-10 (opportunistic): all 8 docs.rs/alkhttp placeholder ADR links +
  the one relative ../docs link converted to plain text; the 10
  pre-existing private/redundant intra-doc-link warnings fixed —
  RUSTDOCFLAGS="-D warnings" cargo doc is fully clean
- HY-11 decision: docs/ + tasks/ excluded from the published package
  (contributor-facing design/process material; ADR references degrade
  to plain text uniformly). cargo publish --dry-run: 38 files, ~889 KiB,
  zero docs/ or tasks/ entries
- HY-04 decision: keep + document — frame_channel0_chunk's unwrap is
  on serializing the acyclic EventEnvelope (unreachable failure);
  # Panics on it and the adjacent WsClient senders state the contract

Verified: cargo test (299 + 5 TLS), --all-features (370 + suites),
--no-default-features (299), clippy --all-targets -D warnings
(default + all-features), fmt --check, cargo doc -D warnings clean,
cargo publish --dry-run --allow-dirty clean.

Tasks: review-001-missing-docs-sweep (final pending task; 42/42)

src/adapters/forward.rs

@@ -17,8 +17,8 @@
 //! sends must match what `/schema` advertises, so peer-supplied input
 //! cannot add upstream query parameters, headers, or craft a request body
 //! the contract does not declare. Declared keys route by designation: a
-//! property marked [`HEADER_PARAM_IN_MARKER`]` = "header"` is sent as a
-//! request header, the declared [`GATEWAY_BODY_KEY`] property becomes the
+//! property marked with the `HEADER_PARAM_IN_MARKER` marker key set to "header" is sent as a
+//! request header, the declared `GATEWAY_BODY_KEY` property becomes the
 //! request body, and every other declared key becomes an upstream query
 //! parameter.
 
@@ -79,17 +79,40 @@ pub(crate) const GATEWAY_BODY_KEY: &str = "body";
 pub(crate) const HEADER_PARAM_IN_MARKER: &str = "wire";
 pub(crate) const HEADER_PARAM_MARKER_VALUE: &str = "header";
 
+/// The credential scheme forwarded handlers apply to outbound requests
+/// (ADR-014). The credential value itself flows through
+/// `OperationContext.capabilities` at call time — never through this
+/// config.
 #[derive(Clone)]
 pub enum HttpAuthScheme {
+    /// `Authorization: Bearer <token>` from the caller's `Bearer`
+    /// capability.
     Bearer,
-    ApiKey { header_name: String },
+    /// A named API-key header (e.g. `x-api-key`) carrying the caller's
+    /// `ApiKey` capability value.
+    ApiKey {
+        /// The upstream header the key is sent in.
+        header_name: String,
+    },
+    /// HTTP Basic auth from the caller's `username`/`password`
+    /// capability pair.
     Basic,
 }
 
+/// Assembly-time configuration for one imported HTTP service: the
+/// registry namespace its operations land under, where traffic goes,
+/// and how credentials attach.
 pub struct HttpServiceConfig {
+    /// Registry namespace for the imported operations (the
+    /// `<namespace>/<operationId>` op names).
     pub namespace: String,
+    /// Outbound base URL every path template is resolved against.
     pub base_url: String,
+    /// Credential scheme for outbound requests; `None` sends an
+    /// unauthenticated request.
     pub auth: Option<HttpAuthScheme>,
+    /// Static headers attached to every outbound request (e.g. a
+    /// required `User-Agent`).
     pub default_headers: HashMap<String, String>,
 }