phase 4: connectrpc on the gateway authenticated edge

Replace the native-gRPC server bootstrap with a single
`connectrpc.com/connect` HTTP/h2c listener. Connect-Go natively
serves Connect, gRPC, and gRPC-Web on the same port, so browsers can
now reach the authenticated surface without giving up the gRPC
framing native and desktop clients may use later. The decorator
stack (envelope → session → payload-hash → signature →
freshness/replay → rate-limit → routing/push) is reused unchanged
behind a small Connect → gRPC adapter and a `grpc.ServerStream`
shim around `*connect.ServerStream`.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

gateway/docs/runtime.md

@@ -7,12 +7,12 @@ runtime dependencies.
 flowchart LR
     subgraph Clients
         Public["Public REST clients"]
-        Authd["Authenticated gRPC clients"]
+        Authd["Authenticated edge clients\n(Connect / gRPC / gRPC-Web)"]
     end
 
     subgraph Gateway["Edge Gateway process"]
         PublicHTTP["Public HTTP listener\n/healthz /readyz /api/v1/public/auth/*"]
-        AuthGRPC["Authenticated gRPC listener\nExecuteCommand / SubscribeEvents"]
+        AuthGRPC["Authenticated edge listener (h2c)\nConnect / gRPC / gRPC-Web\nExecuteCommand / SubscribeEvents"]
         AdminHTTP["Optional admin HTTP listener\n/metrics"]
         BackendREST["backendclient.RESTClient\nsessions + public auth + user/lobby"]
         BackendPush["backendclient.PushClient\nSubscribePush consumer"]
@@ -48,9 +48,13 @@ Notes:
 
 - `cmd/gateway` refuses startup when Redis connectivity, the backend endpoint,
   or the response signer is misconfigured.
-- Session lookup is synchronous: every authenticated gRPC request triggers one
+- Session lookup is synchronous: every authenticated edge request triggers one
   `GET /api/v1/internal/sessions/{id}` call to backend; there is no
   process-local projection.
+- The authenticated edge listener is built on `connectrpc.com/connect` and
+  natively serves the Connect, gRPC, and gRPC-Web protocols on a single
+  HTTP/2 cleartext (`h2c`) port. Browsers use Connect; native clients can
+  use either Connect or raw gRPC framing against the same listener.
 - `backendclient.PushClient` keeps a long-lived `Push.SubscribePush` stream
   open. The dispatcher converts inbound `pushv1.PushEvent` frames into either
   `PushHub.Publish` (for client events) or `PushHub.RevokeDeviceSession` /