feat(gateway): the 5 core gateway routes wired into the router

- src/gateway/routes.rs: /search /schema /call /batch /subscribe
- SSE projection: data frames per event, error event terminates,
  internal/unknown ops -> NOT_FOUND, query-op -> INVALID_OPERATION_TYPE
- /search + /schema ACL-filtered via services/list + services/schema
  discovery handlers; /batch ordered per-item envelope JSON
- gateway_router() merged into HttpAdapter's router under the shared
  bearer-auth route layer; decoy remains the fallback
- adapted to alkcall 0.1.1: OperationType::Sub, envelope error by value

Verified: cargo test (71 lib tests), clippy -D warnings, fmt.

src/server/adapter.rs

@@ -133,6 +133,7 @@ fn build_router(state: RouterState, extra_routes: Option<Router>) -> Router {
     let auth_state = Arc::clone(&state.identity_provider);
 
     let default: Router<RouterState> = Router::new()
+        .merge(crate::gateway::routes::gateway_router())
         .route("/healthz", get(healthz))
         .route_layer(from_fn_with_state(
             auth_state.clone(),