feat(rpc): transport, server, client, http, mounting, docs (Tasks 5-11)

Brings the uncommitted body of work under version control so it cannot be
lost. Gates are green: 152 tests pass across rpc/router/dev-server,
typecheck, lint, format and check:public-api all clean.

NOT YET REVIEWED. None of Tasks 5-11 has had an independent task review, and
Task 4's second fix round was never re-reviewed either.

Known gaps against the plan, recorded here rather than discovered later:
- packages/rpc/test/{transport,server,client}.test.ts are ABSENT. The plan
  required a test file for each. server.ts holds the fail-closed identity and
  permission checks and currently has no direct coverage at all.
- rpc-endpoint.test.ts has 3 tests where the plan specified 9. Missing:
  unknown service, non-POST, malformed body, non-rpc passthrough, and the
  isInternalCaller sweep. This is the task where a reachable
  /__wrnexus/rpc/* makes every permission check in the workspace bypassable.
- http.test.ts has 3 of 7; integration.test.ts 2 of 3;
  services-discovery.test.ts 1 of 4.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

packages/dev-server/src/rpc-dispatch.ts

@@ -0,0 +1,44 @@
+import { RPC_IDENTITY_HEADER, RPC_PATH_PREFIX, type ServiceImplementation } from "@wrnexus/rpc";
+
+export const RPC_INTERNAL_HEADER = "x-wrnexus-internal";
+const EDGE_HEADERS = ["x-forwarded-for", "x-forwarded-host", "x-forwarded-proto", "forwarded"];
+
+export function isRpcPath(pathname: string): boolean {
+  return pathname === RPC_PATH_PREFIX || pathname.startsWith(`${RPC_PATH_PREFIX}/`);
+}
+
+export function isInternalCaller(req: Request): boolean {
+  return (
+    req.headers.get(RPC_INTERNAL_HEADER) === "1" &&
+    !EDGE_HEADERS.some((name) => req.headers.has(name))
+  );
+}
+
+function json(body: unknown, status = 200): Response {
+  return Response.json(body, { status, headers: { "cache-control": "private, no-store" } });
+}
+
+export async function handleRpcRequest(
+  req: Request,
+  url: URL,
+  services: Map<string, ServiceImplementation>,
+): Promise<Response | null> {
+  if (!isRpcPath(url.pathname)) return null;
+  if (!isInternalCaller(req)) return new Response("Not found", { status: 404 });
+  if (req.method !== "POST") return new Response("Method not allowed", { status: 405 });
+  const segments = url.pathname.split("/");
+  const service = segments[3] ? services.get(segments[3]) : undefined;
+  const procedure = segments[4];
+  if (!service || !procedure || segments.length !== 5) {
+    return json({ ok: false, code: "RPC_UNKNOWN", message: "Unknown procedure", retryable: false });
+  }
+  let payload: unknown;
+  try {
+    payload = await req.json();
+  } catch {
+    return json({ ok: false, code: "RPC_INVALID", message: "Invalid input", retryable: false });
+  }
+  return json(
+    await service.invoke(procedure, payload, req.headers.get(RPC_IDENTITY_HEADER) ?? undefined),
+  );
+}