fix(gateway): internal-op invisibility on /schema + cache headers (SRV-02, PRJ-06, GW-02)
- SRV-02: schema_handler applies the same is_internal_op -> 404 pre-check
as /call, /batch, /subscribe, /publish (tested unauthenticated,
anonymous-token, unauthorized-identity)
- PRJ-06: MCP schema tool runs the symmetric pre-check (NOT_FOUND for
internal, FORBIDDEN for ACL-denied) before dispatch; enshrining test
fixed
- GW-02: /search + /schema carry Cache-Control: no-store and
Vary: Authorization on success and error responses
Verification: cargo test 270 passed; --all-features 337+9+6+8+10 passed;
clippy -D warnings clean (default + --all-features); fmt clean.
glm-5.3-flash
239f11323e