feat: server foundation (phase 1 core) — state, auth, healthz/decoy, gateway dispatch, HttpAdapter

Tasks completed: server-core-types, server-auth, server-healthz-decoy,
gateway-dispatch, server-adapter (5 of 17).

- src/server/state.rs: DecoyConfig + RouterState (alkcall type paths,
  6-endpoint reserved-path docs)
- src/server/auth.rs: bearer middleware + ResolvedIdentity extractor
  (10 tests: missing/malformed/basic/failed-resolution matrix)
- src/server/healthz.rs + decoy.rs: raw healthz; nginx-style 404,
  static site (path-traversal guarded), redirect decoys
- src/gateway/dispatch.rs: GatewayDispatch invoke/invoke_streaming
  (internal:false, forwarded_for:None, bounded deadline) +
  src/gateway/error.rs: CallError→HTTP status mapping (HTTP_<status>
  passthrough, retryable→Retry-After)
- src/server/adapter.rs: HttpAdapter ProtocolHandler — accept_bi →
  BiStream → TokioIo → hyper auto builder (h2 CONNECT enabled);
  integration tests over DuplexStream (request/response cycle, healthz,
  decoy 404)

Verified: cargo test (46 lib tests), clippy -D warnings, fmt,
test --all-features.

tasks/server/adapter.md

@@ -1,7 +1,7 @@
 ---
 id: server-adapter
 name: HttpAdapter — ProtocolHandler with hyper over BiStream
-status: pending
+status: completed
 depends_on: [server-core-types, server-auth, server-healthz-decoy]
 scope: moderate
 risk: medium
@@ -24,11 +24,11 @@ the axum `Router` (built once at construction, `with_decoy` /
 
 ## Acceptance Criteria
 
-- [ ] `HttpAdapter::new/h2/for_alpn` + `with_decoy` + `with_extra_routes` ported
-- [ ] `ProtocolHandler` impl drives hyper over the BiStream; returns on connection close
-- [ ] Router merges extra routes; default surface wins collisions
-- [ ] Integration test: full HTTP request/response cycle over `tokio::io::DuplexStream` → `Connection::from_bidi` → adapter
-- [ ] `cargo test` passes; feature gates `h2`/`http1` both compile
+- [x] `HttpAdapter::new/h2/for_alpn` + `with_decoy` + `with_extra_routes` ported
+- [x] `ProtocolHandler` impl drives hyper over the BiStream; returns on connection close
+- [x] Router merges extra routes; default surface wins collisions
+- [x] Integration test: full HTTP request/response cycle over `tokio::io::DuplexStream` → `Connection::from_bidi` → adapter
+- [x] `cargo test` passes; feature gates `h2`/`http1` both compile
 
 ## References
 
@@ -42,4 +42,10 @@ the axum `Router` (built once at construction, `with_decoy` /
 
 ## Summary
 
-> Agent fills on completion.
+Ported `src/server/adapter.rs`: HttpAdapter (ProtocolHandler for
+h2/http1.1), accept_bi→BiStream→TokioIo→hyper auto builder with
+h2 connect-protocol enabled, with_decoy/with_extra_routes builders,
+RESERVED_PATHS + WS_UPGRADE_PATH constants (WS handler wired in the
+websocket task). Integration tests: full request/response cycle,
+healthz, decoy 404 — all over tokio DuplexStream → Connection::from_bidi
+→ ProtocolHandler::handle.