feat: server foundation (phase 1 core) — state, auth, healthz/decoy, gateway dispatch, HttpAdapter

Tasks completed: server-core-types, server-auth, server-healthz-decoy,
gateway-dispatch, server-adapter (5 of 17).

- src/server/state.rs: DecoyConfig + RouterState (alkcall type paths,
  6-endpoint reserved-path docs)
- src/server/auth.rs: bearer middleware + ResolvedIdentity extractor
  (10 tests: missing/malformed/basic/failed-resolution matrix)
- src/server/healthz.rs + decoy.rs: raw healthz; nginx-style 404,
  static site (path-traversal guarded), redirect decoys
- src/gateway/dispatch.rs: GatewayDispatch invoke/invoke_streaming
  (internal:false, forwarded_for:None, bounded deadline) +
  src/gateway/error.rs: CallError→HTTP status mapping (HTTP_<status>
  passthrough, retryable→Retry-After)
- src/server/adapter.rs: HttpAdapter ProtocolHandler — accept_bi →
  BiStream → TokioIo → hyper auto builder (h2 CONNECT enabled);
  integration tests over DuplexStream (request/response cycle, healthz,
  decoy 404)

Verified: cargo test (46 lib tests), clippy -D warnings, fmt,
test --all-features.

tasks/server/healthz-decoy.md

@@ -1,7 +1,7 @@
 ---
 id: server-healthz-decoy
 name: /healthz raw route and stealth decoy fallback
-status: pending
+status: completed
 depends_on: [server-core-types]
 scope: narrow
 risk: low
@@ -20,10 +20,10 @@ Tests: healthz responds without auth; decoy serves all three configs.
 
 ## Acceptance Criteria
 
-- [ ] `/healthz` returns 200 text/plain without auth
-- [ ] Decoy fallback for unmatched paths per DecoyConfig (404/static/redirect)
-- [ ] Reserved paths (6 gateway + /healthz + /openapi.json + /mcp + /alk/channels) never hit the decoy
-- [ ] `cargo test` passes
+- [x] `/healthz` returns 200 text/plain without auth
+- [x] Decoy fallback for unmatched paths per DecoyConfig (404/static/redirect)
+- [x] Reserved paths (6 gateway + /healthz + /openapi.json + /mcp + /alk/channels) never hit the decoy
+- [x] `cargo test` passes
 
 ## References
 
@@ -36,4 +36,8 @@ Tests: healthz responds without auth; decoy serves all three configs.
 
 ## Summary
 
-> Agent fills on completion.
+Ported `src/server/healthz.rs` (raw 200 "ok", no auth) and
+`src/server/decoy.rs` (fake nginx 404 / static site with path-traversal
+guard / redirect). Reserved-path protection is enforced in
+`HttpAdapter`'s router (gateway routes take precedence; decoy is the
+fallback). Tests: 7 decoy + 2 healthz.