phase 4: connectrpc on the gateway authenticated edge

Replace the native-gRPC server bootstrap with a single
`connectrpc.com/connect` HTTP/h2c listener. Connect-Go natively
serves Connect, gRPC, and gRPC-Web on the same port, so browsers can
now reach the authenticated surface without giving up the gRPC
framing native and desktop clients may use later. The decorator
stack (envelope → session → payload-hash → signature →
freshness/replay → rate-limit → routing/push) is reused unchanged
behind a small Connect → gRPC adapter and a `grpc.ServerStream`
shim around `*connect.ServerStream`.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

gateway/docs/runbook.md

@@ -80,8 +80,8 @@ Shutdown behavior:
 - the per-component shutdown budget is controlled by
   `GATEWAY_SHUTDOWN_TIMEOUT`;
 - internal subscribers are stopped as part of application shutdown;
-- the in-memory `PushHub` is closed before gRPC graceful stop;
-- active `SubscribeEvents` streams terminate with gRPC `UNAVAILABLE` and
+- the in-memory `PushHub` is closed before HTTP graceful stop;
+- active `SubscribeEvents` streams terminate with `UNAVAILABLE` and
   message `gateway is shutting down`.
 
 During planned restarts: