feat(rpc): transport, server, client, http, mounting, docs (Tasks 5-11)

Brings the uncommitted body of work under version control so it cannot be
lost. Gates are green: 152 tests pass across rpc/router/dev-server,
typecheck, lint, format and check:public-api all clean.

NOT YET REVIEWED. None of Tasks 5-11 has had an independent task review, and
Task 4's second fix round was never re-reviewed either.

Known gaps against the plan, recorded here rather than discovered later:
- packages/rpc/test/{transport,server,client}.test.ts are ABSENT. The plan
  required a test file for each. server.ts holds the fail-closed identity and
  permission checks and currently has no direct coverage at all.
- rpc-endpoint.test.ts has 3 tests where the plan specified 9. Missing:
  unknown service, non-POST, malformed body, non-rpc passthrough, and the
  isInternalCaller sweep. This is the task where a reachable
  /__wrnexus/rpc/* makes every permission check in the workspace bypassable.
- http.test.ts has 3 of 7; integration.test.ts 2 of 3;
  services-discovery.test.ts 1 of 4.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

packages/dev-server/src/runtime.ts

@@ -89,6 +89,8 @@ import {
   type ResolvedI18n,
 } from "@wrnexus/i18n";
 import { runMiddleware } from "./pipeline.ts";
+import { handleRpcRequest } from "./rpc-dispatch.ts";
+import type { ServiceImplementation } from "@wrnexus/rpc";
 import type { HmrHub } from "./hmr.ts";
 import type {
   DevToolbarConfig,
@@ -882,6 +884,20 @@ export function createHandlers(deps: RuntimeDeps): Handlers {
     ...(await getMiddleware()),
   ];
   const maxBodyBytes = deps.maxBodyBytes ?? 10 * 1024 * 1024; // 10 MB default
+  let servicesPromise: Promise<Map<string, ServiceImplementation>> | undefined;
+  const loadServices = () =>
+    (servicesPromise ??= (async () => {
+      const services = new Map<string, ServiceImplementation>();
+      for (const entry of router.services) {
+        const imported = await loadModule(entry.file);
+        const implementation = imported.default as ServiceImplementation | undefined;
+        if (!implementation || typeof implementation.invoke !== "function") {
+          throw new Error(`RPC service ${entry.file} must default-export implement(...)`);
+        }
+        services.set(entry.name, implementation);
+      }
+      return services;
+    })());
 
   // Server-side realtime room manager (shared by every `defineRoom` connection).
   const realtime = createRealtimeRegistry();
@@ -948,6 +964,9 @@ export function createHandlers(deps: RuntimeDeps): Handlers {
     const secure = (res: Response): Response =>
       withSecurityHeaders(req, res, mode, runtimeSecurity, nonce);
 
+    const rpcResponse = await handleRpcRequest(req, url, await loadServices());
+    if (rpcResponse) return secure(rpcResponse);
+
     const preflight = createCorsPreflightResponse(req, deps.security);
     if (preflight) return secure(preflight);