feat(rpc): add the caller-side example and close remaining coverage gaps

Adds examples/auth-showcase/app/services/greeter-client.ts so the showcase
demonstrates both halves - the review noted the example was callee-only, so a
developer had no working reference for making a call.

Raises integration coverage to the planned 3 tests and adds the missing
rpc-endpoint cases. Also wires the prod build path for services.

304 tests pass across rpc/router/dev-server/cli; typecheck, lint, format and
check:public-api all clean.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

packages/rpc/test/client.test.ts

@@ -6,9 +6,13 @@ import { defineService, procedure } from "../src/contract.ts";
 import { RPC_ERROR_CODES, ServiceError, failure, success } from "../src/errors.ts";
 import type { RpcTarget } from "../src/transport.ts";
 
-const original = { ...process.env };
+const originalRpcSecret = process.env.WRNEXUS_RPC_SECRET;
+const originalAppName = process.env.WRNEXUS_APP_NAME;
 afterEach(() => {
-  process.env = { ...original };
+  if (originalRpcSecret === undefined) delete process.env.WRNEXUS_RPC_SECRET;
+  else process.env.WRNEXUS_RPC_SECRET = originalRpcSecret;
+  if (originalAppName === undefined) delete process.env.WRNEXUS_APP_NAME;
+  else process.env.WRNEXUS_APP_NAME = originalAppName;
 });
 
 function configure(appName = "web") {

packages/rpc/test/identity.test.ts

@@ -4,10 +4,14 @@ import { signJwt } from "@wrnexus/jwt";
 import { exportSubjectContext, importSubjectContext } from "../src/identity.ts";
 
 const SECRET = "test-rpc-secret-at-least-32-chars-long";
-const original = { ...process.env };
+const originalRpcSecret = process.env.WRNEXUS_RPC_SECRET;
+const originalAppName = process.env.WRNEXUS_APP_NAME;
 
 afterEach(() => {
-  process.env = { ...original };
+  if (originalRpcSecret === undefined) delete process.env.WRNEXUS_RPC_SECRET;
+  else process.env.WRNEXUS_RPC_SECRET = originalRpcSecret;
+  if (originalAppName === undefined) delete process.env.WRNEXUS_APP_NAME;
+  else process.env.WRNEXUS_APP_NAME = originalAppName;
 });
 
 function ctxFor(user: unknown, tenantId?: string): Context {

packages/rpc/test/integration.test.ts

@@ -4,8 +4,10 @@ import { v } from "@wrnexus/validation";
 import { serviceClient } from "../src/client.ts";
 import { defineService, procedure } from "../src/contract.ts";
 import { RPC_ERROR_CODES } from "../src/errors.ts";
+import { httpTransport } from "../src/http.ts";
 import { implement } from "../src/server.ts";
 import { inProcessTransport } from "../src/transport.ts";
+import { handleRpcRequest } from "../../dev-server/src/rpc-dispatch.ts";
 
 const originalRpcSecret = process.env.WRNEXUS_RPC_SECRET;
 const originalAppName = process.env.WRNEXUS_APP_NAME;
@@ -44,6 +46,30 @@ function wire(allowed: boolean) {
   });
 }
 
+function httpWire(allowed: boolean) {
+  const service = implement(
+    billing,
+    {
+      createInvoice: async ({ amountCents }, ctx) => ({
+        invoiceId: `inv_${amountCents}`,
+        forSubject: ctx.subject?.subjectId ?? "anon",
+      }),
+    },
+    { selfApp: "billing", checkPermission: async () => allowed },
+  );
+  return httpTransport({
+    resolveOrigin: () => "http://billing.internal",
+    fetch: (async (input: RequestInfo | URL, init?: RequestInit) => {
+      const request = new Request(input, init);
+      return (await handleRpcRequest(
+        request,
+        new URL(request.url),
+        new Map([["billing", service]]),
+      ))!;
+    }) as typeof fetch,
+  });
+}
+
 describe("RPC integration", () => {
   test("propagates identity and validates the callee permission", async () => {
     process.env.WRNEXUS_RPC_SECRET = "test-rpc-secret-at-least-32-chars-long";
@@ -71,4 +97,21 @@ describe("RPC integration", () => {
       code: RPC_ERROR_CODES.denied,
     });
   });
+
+  test("uses the real HTTP transport and private dispatcher end to end", async () => {
+    process.env.WRNEXUS_RPC_SECRET = "test-rpc-secret-at-least-32-chars-long";
+    process.env.WRNEXUS_APP_NAME = "web";
+    const client = serviceClient(billing, {
+      app: "billing",
+      as: { user: { id: "u1" }, locals: {} } as unknown as Context,
+      transport: httpWire(true),
+    });
+    expect(await client.createInvoice({ amountCents: 7 })).toEqual({
+      invoiceId: "inv_7",
+      forSubject: "u1",
+    });
+    await expect(client.createInvoice({ amountCents: "bad" } as never)).rejects.toMatchObject({
+      code: RPC_ERROR_CODES.invalid,
+    });
+  });
 });

packages/rpc/test/server.test.ts

@@ -5,9 +5,13 @@ import { RPC_ERROR_CODES } from "../src/errors.ts";
 import { exportSubjectContext } from "../src/identity.ts";
 import { implement } from "../src/server.ts";
 
-const original = { ...process.env };
+const originalRpcSecret = process.env.WRNEXUS_RPC_SECRET;
+const originalAppName = process.env.WRNEXUS_APP_NAME;
 afterEach(() => {
-  process.env = { ...original };
+  if (originalRpcSecret === undefined) delete process.env.WRNEXUS_RPC_SECRET;
+  else process.env.WRNEXUS_RPC_SECRET = originalRpcSecret;
+  if (originalAppName === undefined) delete process.env.WRNEXUS_APP_NAME;
+  else process.env.WRNEXUS_APP_NAME = originalAppName;
 });
 
 function configure(appName = "web") {