feat(rpc): transport, server, client, http, mounting, docs (Tasks 5-11)

Brings the uncommitted body of work under version control so it cannot be
lost. Gates are green: 152 tests pass across rpc/router/dev-server,
typecheck, lint, format and check:public-api all clean.

NOT YET REVIEWED. None of Tasks 5-11 has had an independent task review, and
Task 4's second fix round was never re-reviewed either.

Known gaps against the plan, recorded here rather than discovered later:
- packages/rpc/test/{transport,server,client}.test.ts are ABSENT. The plan
  required a test file for each. server.ts holds the fail-closed identity and
  permission checks and currently has no direct coverage at all.
- rpc-endpoint.test.ts has 3 tests where the plan specified 9. Missing:
  unknown service, non-POST, malformed body, non-rpc passthrough, and the
  isInternalCaller sweep. This is the task where a reachable
  /__wrnexus/rpc/* makes every permission check in the workspace bypassable.
- http.test.ts has 3 of 7; integration.test.ts 2 of 3;
  services-discovery.test.ts 1 of 4.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

packages/rpc/src/client.ts

@@ -0,0 +1,57 @@
+import type { Context } from "@wrnexus/core";
+import { RPC_ERROR_CODES, ServiceError } from "./errors.ts";
+import { exportSubjectContext } from "./identity.ts";
+import type { Transport } from "./transport.ts";
+import type {
+  AnyProcedures,
+  InferProcedureInput,
+  InferProcedureOutput,
+  ServiceContract,
+} from "./types.ts";
+
+export interface ServiceClientOptions {
+  app?: string;
+  transport: Transport;
+  as?: Context;
+  timeoutMs?: number;
+}
+
+export type ServiceClient<Procedures extends AnyProcedures> = {
+  [K in keyof Procedures]: (
+    input: InferProcedureInput<Procedures[K]>,
+  ) => Promise<InferProcedureOutput<Procedures[K]>>;
+};
+
+const DEFAULT_TIMEOUT_MS = 10_000;
+
+export function serviceClient<Procedures extends AnyProcedures>(
+  contract: ServiceContract<Procedures>,
+  options: ServiceClientOptions,
+): ServiceClient<Procedures> {
+  const app = options.app ?? contract.name;
+  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  return new Proxy({} as ServiceClient<Procedures>, {
+    get(_target, property) {
+      if (typeof property !== "string") return undefined;
+      return async (input: unknown) => {
+        if (!Object.hasOwn(contract.procedures, property)) {
+          throw new ServiceError(RPC_ERROR_CODES.unknown, "Unknown procedure");
+        }
+        const identity = options.as ? await exportSubjectContext(options.as, app) : undefined;
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), timeoutMs);
+        try {
+          const result = await options.transport.call(
+            { app, service: contract.name, procedure: property },
+            input,
+            { signal: controller.signal, ...(identity ? { identity } : {}) },
+          );
+          if (result.ok) return result.value;
+          throw new ServiceError(result.code, result.message);
+        } finally {
+          clearTimeout(timer);
+        }
+      };
+    },
+  });
+}