feat(rpc): transport, server, client, http, mounting, docs (Tasks 5-11)

Brings the uncommitted body of work under version control so it cannot be
lost. Gates are green: 152 tests pass across rpc/router/dev-server,
typecheck, lint, format and check:public-api all clean.

NOT YET REVIEWED. None of Tasks 5-11 has had an independent task review, and
Task 4's second fix round was never re-reviewed either.

Known gaps against the plan, recorded here rather than discovered later:
- packages/rpc/test/{transport,server,client}.test.ts are ABSENT. The plan
  required a test file for each. server.ts holds the fail-closed identity and
  permission checks and currently has no direct coverage at all.
- rpc-endpoint.test.ts has 3 tests where the plan specified 9. Missing:
  unknown service, non-POST, malformed body, non-rpc passthrough, and the
  isInternalCaller sweep. This is the task where a reachable
  /__wrnexus/rpc/* makes every permission check in the workspace bypassable.
- http.test.ts has 3 of 7; integration.test.ts 2 of 3;
  services-discovery.test.ts 1 of 4.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

packages/router/src/index.ts

@@ -61,6 +61,8 @@ export interface Router {
   schemas: ComponentRef[];
   /** Authorization declarations (`app/authz/<name>.ts`) merged into the catalog. */
   authz: ComponentRef[];
+  /** Service implementations (`app/services/<name>.ts`) mounted for inter-app calls. */
+  services: ComponentRef[];
   matchPage(pathname: string): RouteMatch | null;
   matchApi(pathname: string): RouteMatch | null;
   matchRealtime(pathname: string): RouteMatch | null;
@@ -302,6 +304,17 @@ export function buildRouter(appDir: string, opts: RouterOptions = {}): Router {
     authz.push({ name, file: f.file });
   }
 
+  const services: ComponentRef[] = [];
+  for (const f of scanDir(join(appDir, "services"), [".js"])) {
+    if (!/\.(ts|js)$/.test(f.file) || /[.]gen[.](ts|js)$/.test(f.file)) continue;
+    const name = basename(f.file).replace(/\.(ts|js)$/, "");
+    if (!isSafeIslandName(name)) {
+      console.warn(`[wrnexus] skipping service with unsafe name: ${name}`);
+      continue;
+    }
+    services.push({ name, file: f.file });
+  }
+
   return {
     pages,
     api,
@@ -312,6 +325,7 @@ export function buildRouter(appDir: string, opts: RouterOptions = {}): Router {
     stores,
     schemas,
     authz,
+    services,
     matchPage: (p) => matchRoute(pages, p),
     matchApi: (p) => matchRoute(api, p),
     matchRealtime: (p) => matchRoute(realtime, p),

packages/router/test/services-discovery.test.ts

@@ -0,0 +1,21 @@
+import { describe, expect, test } from "bun:test";
+import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { buildRouter } from "../src/index.ts";
+
+const root = join(import.meta.dir, ".tmp-services");
+mkdirSync(root, { recursive: true });
+
+describe("service discovery", () => {
+  test("discovers source services and skips generated files", () => {
+    const base = mkdtempSync(join(root, "app-"));
+    const services = join(base, "app", "services");
+    mkdirSync(services, { recursive: true });
+    mkdirSync(join(base, "app", "pages"), { recursive: true });
+    writeFileSync(join(services, "billing.ts"), "export default {};");
+    writeFileSync(join(services, "types.gen.ts"), "export type T = string;");
+    expect(buildRouter(join(base, "app")).services.map((service) => service.name)).toEqual([
+      "billing",
+    ]);
+  });
+});