fix(gateway): unify INVALID_INPUT to 422 on hand-rolled paths + sink deadline (GW-16, GW-17)

GW-16: empty body / malformed first line / missing header fields /
per-line cap / batch over-cap rejections now route through
call_error_to_http_response_with_identity, mapping INVALID_INPUT to
422 — same status as mid-stream chunk errors. One error class, one
status.

GW-17: invoke_sink wraps the registry sink invoke in the same 30 s
tokio::time::timeout the Once-op invoke uses; a hung sink handler
surfaces as a TIMEOUT (504, retryable) error envelope instead of
holding the HTTP connection forever. The sink wrapper bounds the
whole dispatch (chunk pacing included), matching http-server.md's
deadline contract.

Docs: http-server.md error table documents the 422 triggers and the
sink deadline; http-adapters.md batch cap status corrected.

to_openapi: gateway spec version 1.3.0 -> 1.4.0 (ADR-045 minor):
/publish framing faults and /batch cap reject documented at 422 (the
400 slots moved with the runtime); /publish 400 slot removed; 504
description covers the sink dispatch.

Verification: scripts/verify.sh OK (397 tests); cargo test
--all-features OK (513 tests); clippy --all-features --all-targets -D
warnings OK; cargo fmt --check OK.

docs/architecture/http-adapters.md

@@ -545,7 +545,9 @@ adapter contract from alkcall ADR-022 faithful on the error axis — no
 silent dropping of error contracts. The `/batch` endpoint documents no
 HTTP 500 (review-002 PRJ-21): every per-entry dispatch failure is an
 in-band `results[]` entry; the only HTTP error status is the
-request-level cap failure (400). `BatchResultEntry.error` references
+request-level cap failure (422; GW-16 unified it with the
+`INVALID_INPUT → 422` mapping — it was hand-rolled as 400 before
+review-002). `BatchResultEntry.error` references
 the `BatchError` component (review-002 PRJ-16b): the serialized
 `CallError` as a oneOf over the six protocol-code envelopes plus a
 generic arm carrying the operation-declared codes. See alkcall ADR-016.