feat(rpc): transport, server, client, http, mounting, docs (Tasks 5-11)

Brings the uncommitted body of work under version control so it cannot be
lost. Gates are green: 152 tests pass across rpc/router/dev-server,
typecheck, lint, format and check:public-api all clean.

NOT YET REVIEWED. None of Tasks 5-11 has had an independent task review, and
Task 4's second fix round was never re-reviewed either.

Known gaps against the plan, recorded here rather than discovered later:
- packages/rpc/test/{transport,server,client}.test.ts are ABSENT. The plan
  required a test file for each. server.ts holds the fail-closed identity and
  permission checks and currently has no direct coverage at all.
- rpc-endpoint.test.ts has 3 tests where the plan specified 9. Missing:
  unknown service, non-POST, malformed body, non-rpc passthrough, and the
  isInternalCaller sweep. This is the task where a reachable
  /__wrnexus/rpc/* makes every permission check in the workspace bypassable.
- http.test.ts has 3 of 7; integration.test.ts 2 of 3;
  services-discovery.test.ts 1 of 4.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

packages/rpc/src/transport.ts

@@ -0,0 +1,38 @@
+import { RPC_ERROR_CODES, failure } from "./errors.ts";
+import type { ServiceResult } from "./types.ts";
+
+export interface RpcTarget {
+  app: string;
+  service: string;
+  procedure: string;
+}
+
+export interface CallOptions {
+  signal?: AbortSignal;
+  identity?: string;
+}
+
+export interface Transport {
+  call(target: RpcTarget, payload: unknown, options: CallOptions): Promise<ServiceResult>;
+}
+
+export type InProcessHandler = (
+  payload: unknown,
+  identity?: string,
+) => Promise<ServiceResult> | ServiceResult;
+
+/** Direct transport for tests and local integration harnesses. */
+export function inProcessTransport(handlers: Record<string, InProcessHandler>): Transport {
+  return {
+    async call(target, payload, options) {
+      if (options.signal?.aborted) return failure(RPC_ERROR_CODES.transport, "Call aborted");
+      const handler = handlers[`${target.service}/${target.procedure}`];
+      if (!handler) return failure(RPC_ERROR_CODES.unknown, "Unknown procedure");
+      try {
+        return await handler(payload, options.identity);
+      } catch {
+        return failure(RPC_ERROR_CODES.handler, "Internal error");
+      }
+    },
+  };
+}