feat(rpc): transport, server, client, http, mounting, docs (Tasks 5-11)

Brings the uncommitted body of work under version control so it cannot be
lost. Gates are green: 152 tests pass across rpc/router/dev-server,
typecheck, lint, format and check:public-api all clean.

NOT YET REVIEWED. None of Tasks 5-11 has had an independent task review, and
Task 4's second fix round was never re-reviewed either.

Known gaps against the plan, recorded here rather than discovered later:
- packages/rpc/test/{transport,server,client}.test.ts are ABSENT. The plan
  required a test file for each. server.ts holds the fail-closed identity and
  permission checks and currently has no direct coverage at all.
- rpc-endpoint.test.ts has 3 tests where the plan specified 9. Missing:
  unknown service, non-POST, malformed body, non-rpc passthrough, and the
  isInternalCaller sweep. This is the task where a reachable
  /__wrnexus/rpc/* makes every permission check in the workspace bypassable.
- http.test.ts has 3 of 7; integration.test.ts 2 of 3;
  services-discovery.test.ts 1 of 4.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

packages/dev-server/test/gateway.test.ts

@@ -4,6 +4,7 @@ import {
   forwardAuthFailure,
   forwardAuthHeaders,
   gatewayProxyHeaders,
+  stripUntrustedInternalHeaders,
   gatewayRestartDelay,
   internalError,
   stripInternalError,
@@ -34,6 +35,16 @@ test("gateway disables compression for its internal proxy hop", () => {
   expect(headers.get("x-forwarded-for")).toBe("127.0.0.1");
 });
 
+test("gateway proxy headers do not preserve the RPC internal marker", () => {
+  const request = new Request("http://localhost:3000/path", {
+    headers: { "x-wrnexus-internal": "1" },
+  });
+  const headers = stripUntrustedInternalHeaders(
+    gatewayProxyHeaders(request, new URL(request.url), "127.0.0.1", true),
+  );
+  expect(headers.has("x-wrnexus-internal")).toBe(false);
+});
+
 test("forward auth preserves intentional verifier redirects", () => {
   const redirected = forwardAuthFailure(
     new Response(null, { status: 302, headers: { location: "/login?returnTo=%2Fadmin" } }),