feat: server foundation (phase 1 core) — state, auth, healthz/decoy, gateway dispatch, HttpAdapter

Tasks completed: server-core-types, server-auth, server-healthz-decoy,
gateway-dispatch, server-adapter (5 of 17).

- src/server/state.rs: DecoyConfig + RouterState (alkcall type paths,
  6-endpoint reserved-path docs)
- src/server/auth.rs: bearer middleware + ResolvedIdentity extractor
  (10 tests: missing/malformed/basic/failed-resolution matrix)
- src/server/healthz.rs + decoy.rs: raw healthz; nginx-style 404,
  static site (path-traversal guarded), redirect decoys
- src/gateway/dispatch.rs: GatewayDispatch invoke/invoke_streaming
  (internal:false, forwarded_for:None, bounded deadline) +
  src/gateway/error.rs: CallError→HTTP status mapping (HTTP_<status>
  passthrough, retryable→Retry-After)
- src/server/adapter.rs: HttpAdapter ProtocolHandler — accept_bi →
  BiStream → TokioIo → hyper auto builder (h2 CONNECT enabled);
  integration tests over DuplexStream (request/response cycle, healthz,
  decoy 404)

Verified: cargo test (46 lib tests), clippy -D warnings, fmt,
test --all-features.

tasks/gateway/dispatch.md

@@ -1,7 +1,7 @@
 ---
 id: gateway-dispatch
 name: GatewayDispatch — shared dispatch spine (invoke + streaming)
-status: pending
+status: completed
 depends_on: [server-core-types]
 scope: moderate
 risk: medium
@@ -27,10 +27,10 @@ FORBIDDEN→401/403, INVALID_INPUT→422, TIMEOUT→504, INTERNAL→500,
 
 ## Acceptance Criteria
 
-- [ ] `invoke()` + `invoke_streaming()` ported against alkcall dispatch
-- [ ] Error mapping table ported with unit tests per row
-- [ ] Internal ops → 404 before ACL; ACL failure → 401/403 distinction preserved
-- [ ] `cargo test` passes
+- [x] `invoke()` + `invoke_streaming()` ported against alkcall dispatch
+- [x] Error mapping table ported with unit tests per row
+- [x] Internal ops → 404 before ACL; ACL failure → 401/403 distinction preserved
+- [x] `cargo test` passes
 
 ## References
 
@@ -44,4 +44,9 @@ FORBIDDEN→401/403, INVALID_INPUT→422, TIMEOUT→504, INTERNAL→500,
 
 ## Summary
 
-> Agent fills on completion.
+Ported `src/gateway/dispatch.rs` (GatewayDispatch: invoke +
+invoke_streaming, root OperationContext construction with
+internal:false / forwarded_for:None, deadline bounded for once-ops) and
+`src/gateway/error.rs` (CallError→HTTP mapping per row, HTTP_<status>
+passthrough, retryable→Retry-After). Tests adapted to alkcall's
+`ResponseEnvelope.result: Result<Value, CallError>` shape.