feat(gateway): the 5 core gateway routes wired into the router

- src/gateway/routes.rs: /search /schema /call /batch /subscribe
- SSE projection: data frames per event, error event terminates,
  internal/unknown ops -> NOT_FOUND, query-op -> INVALID_OPERATION_TYPE
- /search + /schema ACL-filtered via services/list + services/schema
  discovery handlers; /batch ordered per-item envelope JSON
- gateway_router() merged into HttpAdapter's router under the shared
  bearer-auth route layer; decoy remains the fallback
- adapted to alkcall 0.1.1: OperationType::Sub, envelope error by value

Verified: cargo test (71 lib tests), clippy -D warnings, fmt.

tasks/gateway/routes.md

@@ -1,7 +1,7 @@
 ---
 id: gateway-routes
 name: The 5 core gateway routes wired into the router
-status: pending
+status: completed
 depends_on: [gateway-dispatch, server-adapter]
 scope: moderate
 risk: medium
@@ -25,11 +25,11 @@ events, batch correlation.
 
 ## Acceptance Criteria
 
-- [ ] 5 routes ported and wired in server-adapter's router
-- [ ] SSE framing tests (multi-event, error-terminates, client-disconnect)
-- [ ] /search returns only ops the caller's identity can invoke
-- [ ] Full request→dispatch→response test over DuplexStream
-- [ ] `cargo test` passes
+- [x] 5 routes ported and wired in server-adapter's router
+- [x] SSE framing tests (multi-event, error-terminates, client-disconnect)
+- [x] /search returns only ops the caller's identity can invoke
+- [x] Full request→dispatch→response test over DuplexStream
+- [x] `cargo test` passes
 
 ## References
 
@@ -42,4 +42,18 @@ events, batch correlation.
 
 ## Summary
 
-> Agent fills on completion.
+Ported `src/gateway/routes.rs`: GatewayState (FromRef<RouterState>),
+`gateway_router()` with the 5 fixed endpoints, SSE subscription
+projection (multi-event data frames, error-terminates,
+internal/unknown → NOT_FOUND error event, query-op →
+INVALID_OPERATION_TYPE), /search ACL-filtered discovery via
+`services/list`, /schema access pre-check + `services/schema`, /batch
+ordered per-item envelopes, /call with leading-slash tolerance.
+Wired `gateway_router()` into HttpAdapter's build_router under the
+shared bearer-auth route layer.
+
+Adaptations for alkcall 0.1.1: `OperationType::Sub` (not
+`Subscription`), `ResponseEnvelope::error(request_id, error)` by value,
+`composition_authority.clone()` when re-registering discovery inner ops.
+
+23 tests: full endpoint matrix over oneshot routers. 71 lib tests green.