Merge feat/http-upgrade-handler: WebSocket upgrade handler (native EventEnvelope session, no length prefix)

Implements src/websocket/upgrade.rs: WS upgrade at /alknet/call using axum
WebSocketUpgrade, bearer auth (no token → 401), CallConnection::new_overlay_only,
native EventEnvelope over binary WS messages (no length prefix, text → close 1002),
Dispatcher::dispatch_requested for call.requested (AccessControl gates), handle_abort
for call.aborted, PendingRequestMap correlation, fail_all_pending on disconnect
(ADR-016 cascade), bidirectionality via connection-local overlay. Wired /alknet/call
route into adapter.rs. 168 tests pass.

crates/alknet-http/src/server/adapter.rs

@@ -32,6 +32,8 @@ use alknet_core::types::{Connection, HandlerError, ProtocolHandler, StreamError}
 use super::auth::bearer_auth_middleware;
 use crate::server::decoy::decoy_fallback;
 use crate::server::healthz::healthz;
+use crate::websocket::upgrade::ws_upgrade_handler;
+use crate::websocket::upgrade::WS_UPGRADE_PATH;
 
 const ALPN_HTTP1: &[u8] = b"http/1.1";
 const ALPN_H2: &[u8] = b"h2";
@@ -58,6 +60,18 @@ impl axum::extract::FromRef<RouterState> for DecoyConfig {
     }
 }
 
+impl axum::extract::FromRef<RouterState> for Arc<OperationRegistry> {
+    fn from_ref(state: &RouterState) -> Self {
+        Arc::clone(&state.registry)
+    }
+}
+
+impl axum::extract::FromRef<RouterState> for Arc<dyn IdentityProvider> {
+    fn from_ref(state: &RouterState) -> Self {
+        Arc::clone(&state.identity_provider)
+    }
+}
+
 pub struct HttpAdapter {
     identity_provider: Arc<dyn IdentityProvider>,
     registry: Arc<OperationRegistry>,
@@ -143,6 +157,7 @@ fn build_router(state: RouterState, extra_routes: Option<Router>) -> Router {
         .route("/subscribe", any(not_implemented))
         .route("/openapi.json", get(not_implemented))
         .route("/mcp", post(not_implemented))
+        .route(WS_UPGRADE_PATH, get(ws_upgrade_handler))
         .route_layer(from_fn_with_state(auth_state.clone(), bearer_auth_middleware))
         .route("/healthz", get(healthz))
         .fallback(decoy_fallback);

crates/alknet-http/src/websocket/mod.rs

@@ -4,6 +4,8 @@
 //! native `EventEnvelope` call-protocol session, not the gateway shape
 //! (ADR-048). See `docs/architecture/crates/http/websocket.md`.
 
+pub mod upgrade;
+
 #[cfg(test)]
 mod tests {
     use std::collections::HashMap;