feat(http): implement GatewayDispatch shared dispatch spine

Thin concrete struct (not a trait) holding Arc<OperationRegistry> +
Arc<dyn IdentityProvider>. Exposes resolve_bearer() (delegates to
identity_provider.resolve_from_token) and invoke() which builds a root
OperationContext for wire-ingress (internal: false, forwarded_for: None,
fresh UUID v4 request_id, deadline now+30s) carrying the registration
bundle's composition_authority/capabilities/scoped_env, then calls
OperationRegistry::invoke. Dispatches services/list and services/schema
unchanged (registered ops); AccessControl filtering in services/list
sees the caller's resolved identity. Re-exported from lib.rs.

Duplicates Dispatcher::build_root_context construction (the alknet-call
version is pub(crate) and tangled with CallConnection peer/session
overlays); the invariants (internal: false, forwarded_for: None) are
the load-bearing part and identical to the wire-ingress path.

crates/alknet-http/src/gateway/mod.rs

@@ -4,4 +4,6 @@
 //! `/subscribe`) are the sole HTTP invoke path (ADR-042/047). See
 //! `docs/architecture/crates/http/http-server.md`.
 
-// TODO: implement
+pub mod dispatch;
+
+pub use dispatch::GatewayDispatch;