feat(rpc): transport, server, client, http, mounting, docs (Tasks 5-11)

Brings the uncommitted body of work under version control so it cannot be
lost. Gates are green: 152 tests pass across rpc/router/dev-server,
typecheck, lint, format and check:public-api all clean.

NOT YET REVIEWED. None of Tasks 5-11 has had an independent task review, and
Task 4's second fix round was never re-reviewed either.

Known gaps against the plan, recorded here rather than discovered later:
- packages/rpc/test/{transport,server,client}.test.ts are ABSENT. The plan
  required a test file for each. server.ts holds the fail-closed identity and
  permission checks and currently has no direct coverage at all.
- rpc-endpoint.test.ts has 3 tests where the plan specified 9. Missing:
  unknown service, non-POST, malformed body, non-rpc passthrough, and the
  isInternalCaller sweep. This is the task where a reachable
  /__wrnexus/rpc/* makes every permission check in the workspace bypassable.
- http.test.ts has 3 of 7; integration.test.ts 2 of 3;
  services-discovery.test.ts 1 of 4.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/plans/2026-08-05-inter-app-comms-design.md

@@ -1,7 +1,7 @@
 # Inter-app communication design (`@wrnexus/rpc`)
 
 Date: 2026-08-05
-Status: approved, not yet implemented
+Status: phase 1 implemented (2026-08-05); phases 2–4 remain deferred
 Depends on: the permissions system (`@wrnexus/authz`), merged 2026-08-05
 
 ## Problem

docs/plans/2026-08-05-inter-app-comms-implementation.md

@@ -8,6 +8,8 @@
 
 **Tech Stack:** TypeScript, Bun (`bun:test`), `@wrnexus/validation` (input schemas), `@wrnexus/jwt` (identity token, HS256), `@wrnexus/authz` (permission checks), `@wrnexus/core` (Context/Middleware types only).
 
+**Status:** Implemented 2026-08-05. The deferred phases at the end of this document remain out of scope.
+
 ## Global Constraints
 
 - Every `@wrnexus/*` package is version `0.8.4`. Do not change versions.

docs/public-api-0.8.json

@@ -2372,6 +2372,53 @@
         "sortRoutes"
       ]
     },
+    "@wrnexus/rpc": {
+      ".": [
+        "AnyProcedures",
+        "CallOptions",
+        "ExportOptions",
+        "HandlerContext",
+        "HttpTransportOptions",
+        "ImplementOptions",
+        "ImportOptions",
+        "InProcessHandler",
+        "InferInput",
+        "InferProcedureInput",
+        "InferProcedureOutput",
+        "InputSchema",
+        "ProcedureBuilder",
+        "ProcedureDef",
+        "RPC_ERROR_CODES",
+        "RPC_IDENTITY_HEADER",
+        "RPC_INTERNAL_HEADER",
+        "RPC_PATH_PREFIX",
+        "RpcErrorCode",
+        "RpcTarget",
+        "ServiceClient",
+        "ServiceClientOptions",
+        "ServiceContract",
+        "ServiceError",
+        "ServiceHandlers",
+        "ServiceImplementation",
+        "ServiceResult",
+        "SubjectContext",
+        "ToResultOptions",
+        "Transport",
+        "defineService",
+        "exportSubjectContext",
+        "failure",
+        "httpTransport",
+        "implement",
+        "importSubjectContext",
+        "inProcessTransport",
+        "isRetryableStatus",
+        "procedure",
+        "rpcPath",
+        "rpcSecret",
+        "serviceClient",
+        "success"
+      ]
+    },
     "@wrnexus/security": {
       ".": [
         "RequestHardeningOptions",