fix(gateway): proxy browser server functions to workspace apps

packages/rpc/src/http.ts

@@ -27,10 +27,10 @@ function parseOriginMap(value: string | undefined): Record<string, string> {
  *
  * Prefer `WRNEXUS_INTERNAL_ORIGINS` (loopback origins the gateway hands each
  * child before spawning it) over `appOrigin`, which resolves the app's
- * PUBLIC origin. The public origin is the wrong target for RPC: the gateway
- * unconditionally 404s the reserved `/__wrnexus/rpc` prefix on anything that
- * arrives at a public origin — that block is the whole point, it is what
- * keeps inter-app calls off the public internet. Falling back to `appOrigin`
+ * PUBLIC origin. The public origin is the wrong target for inter-app RPC: the
+ * gateway 404s private `/__wrnexus/rpc/<service>/<procedure>` routes. (The
+ * exact prefix remains the CSRF-protected browser server-function endpoint.)
+ * That block keeps inter-app calls off the public internet. Falling back to `appOrigin`
  * when no internal-origin map is present keeps single-app and test setups
  * (which only set `WRNEXUS_WORKSPACE_ORIGINS`) working.
  */