fix(rpc): close the four final-review blockers on inter-app RPC

- Resolve RPC call origins via a new WRNEXUS_INTERNAL_ORIGINS map (loopback
  origins the gateway hands each child before spawning it), falling back to
  the public appOrigin only when it is absent. Calls previously always went
  to the public gateway origin, which the gateway unconditionally 404s on
  the RPC prefix by design — every real cross-app call failed.
- Stop loadServices() from running ahead of routing and stop memoizing a
  rejected load: one bad file under app/services/ no longer permanently
  breaks every route in the app. A failed load logs loudly, is retried on
  the next RPC request, and the RPC path gets a structured RPC_UNKNOWN
  instead of an unhandled throw.
- Reject a service whose contract.name does not match the filename it is
  mounted under, naming both, instead of silently mounting under the
  filename while the typed client calls by contract name.
- Let ServiceError accept an explicit retryable and have the client pass the
  wire value through, instead of recomputing (and silently flipping) it from
  the error code alone.
- Document the gateway/X-Forwarded-* deployment requirement in the RPC
  README.

Each of the three code blockers has a new/extended test that was verified to
fail when its fix was reverted (rpc/test/integration.test.ts,
dev-server/test/rpc-services-loading.test.ts).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

packages/rpc/test/client.test.ts

@@ -189,4 +189,29 @@ describe("serviceClient", () => {
     expect(seenTarget?.app).toBe("billing");
     expect(seenTarget?.service).toBe("billing");
   });
+
+  test("a wire-level non-retryable failure (e.g. a 403) surfaces at the client as retryable: false", async () => {
+    // RPC_TRANSPORT recomputes to retryable: true from the code alone — that
+    // is correct for a 5xx, but the transport already determined a 403 is
+    // NOT retryable via the bounded status check. The client must pass that
+    // wire value through rather than recompute it from the code.
+    const client = serviceClient(billing, {
+      transport: {
+        call: async () => ({
+          ok: false,
+          code: RPC_ERROR_CODES.transport,
+          message: "Service returned 403",
+          retryable: false,
+        }),
+      },
+    });
+    let caught: unknown;
+    try {
+      await client.createInvoice({ amountCents: 1 });
+    } catch (err) {
+      caught = err;
+    }
+    expect(caught).toBeInstanceOf(ServiceError);
+    expect(caught).toMatchObject({ code: RPC_ERROR_CODES.transport, retryable: false });
+  });
 });

packages/rpc/test/integration.test.ts

@@ -114,4 +114,55 @@ describe("RPC integration", () => {
       code: RPC_ERROR_CODES.invalid,
     });
   });
+
+  test("the default httpTransport reaches the callee over a real socket via the internal origin", async () => {
+    const service = implement(
+      billing,
+      {
+        createInvoice: async ({ amountCents }, ctx) => ({
+          invoiceId: `inv_${amountCents}`,
+          forSubject: ctx.subject?.subjectId ?? "anon",
+        }),
+      },
+      { selfApp: "billing", checkPermission: async () => true },
+    );
+    const server = Bun.serve({
+      port: 0,
+      hostname: "127.0.0.1",
+      async fetch(req) {
+        const url = new URL(req.url);
+        const res = await handleRpcRequest(req, url, new Map([["billing", service]]));
+        return res ?? new Response("Not found", { status: 404 });
+      },
+    });
+    const originalWorkspace = process.env.WRNEXUS_WORKSPACE_ORIGINS;
+    const originalInternal = process.env.WRNEXUS_INTERNAL_ORIGINS;
+    try {
+      // The workspace (public) origin deliberately points somewhere that
+      // cannot serve the RPC — the gateway 404s the RPC prefix on any
+      // request that arrives at a public origin. Only the internal-origin
+      // map points at the real server. If httpTransport() ever falls back
+      // to the public origin by default again, this call fails.
+      process.env.WRNEXUS_WORKSPACE_ORIGINS = JSON.stringify({
+        billing: "http://127.0.0.1:1", // unroutable — nothing listens here
+      });
+      process.env.WRNEXUS_INTERNAL_ORIGINS = JSON.stringify({
+        billing: `http://127.0.0.1:${server.port}`,
+      });
+      const client = serviceClient(billing, {
+        app: "billing",
+        transport: httpTransport(), // no resolveOrigin override — uses the real default
+      });
+      expect(await client.createInvoice({ amountCents: 42 })).toEqual({
+        invoiceId: "inv_42",
+        forSubject: "anon",
+      });
+    } finally {
+      server.stop(true);
+      if (originalWorkspace === undefined) delete process.env.WRNEXUS_WORKSPACE_ORIGINS;
+      else process.env.WRNEXUS_WORKSPACE_ORIGINS = originalWorkspace;
+      if (originalInternal === undefined) delete process.env.WRNEXUS_INTERNAL_ORIGINS;
+      else process.env.WRNEXUS_INTERNAL_ORIGINS = originalInternal;
+    }
+  });
 });