feat(rpc): transport, server, client, http, mounting, docs (Tasks 5-11)

Brings the uncommitted body of work under version control so it cannot be
lost. Gates are green: 152 tests pass across rpc/router/dev-server,
typecheck, lint, format and check:public-api all clean.

NOT YET REVIEWED. None of Tasks 5-11 has had an independent task review, and
Task 4's second fix round was never re-reviewed either.

Known gaps against the plan, recorded here rather than discovered later:
- packages/rpc/test/{transport,server,client}.test.ts are ABSENT. The plan
  required a test file for each. server.ts holds the fail-closed identity and
  permission checks and currently has no direct coverage at all.
- rpc-endpoint.test.ts has 3 tests where the plan specified 9. Missing:
  unknown service, non-POST, malformed body, non-rpc passthrough, and the
  isInternalCaller sweep. This is the task where a reachable
  /__wrnexus/rpc/* makes every permission check in the workspace bypassable.
- http.test.ts has 3 of 7; integration.test.ts 2 of 3;
  services-discovery.test.ts 1 of 4.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

bun.lock

@@ -26,6 +26,7 @@
         "@wrnexus/authz": "workspace:*",
         "@wrnexus/captcha": "workspace:*",
         "@wrnexus/core": "workspace:*",
+        "@wrnexus/rpc": "workspace:*",
         "@wrnexus/validation": "workspace:*",
       },
       "devDependencies": {
@@ -245,6 +246,7 @@
         "@wrnexus/pubsub": "workspace:*",
         "@wrnexus/pwa": "workspace:*",
         "@wrnexus/router": "workspace:*",
+        "@wrnexus/rpc": "workspace:*",
         "@wrnexus/security": "workspace:*",
         "@wrnexus/ssr": "workspace:*",
         "@wrnexus/store": "workspace:*",
@@ -450,6 +452,7 @@
       "dependencies": {
         "@wrnexus/authz": "workspace:*",
         "@wrnexus/core": "workspace:*",
+        "@wrnexus/helpers": "workspace:*",
         "@wrnexus/jwt": "workspace:*",
         "@wrnexus/validation": "workspace:*",
       },