fix(gateway): verify client signature before payload_hash

ARCHITECTURE.md §15 "Verification order" specifies signature verification
(step 4) before payload_hash (step 5), but the authenticated-edge
decorator chain wrapped the payload-hash gate outside the signature gate,
so the hash was checked first. gateway/README.md and gateway/docs/flows.md
had drifted to match the code (hash-first), leaving ARCHITECTURE.md as the
lone source describing the intended order.

Swap the two decorators in server.go so the signature gate runs first, and
align README + flows.md to ARCHITECTURE.md. Signature-first is the
cryptographically sound order: the signature covers the payload_hash field,
so the request is authenticated before any of its content is processed.

Observable side effect: a request carrying a tampered payload_hash whose
signature was computed over the original hash is now rejected at the
signature gate (UNAUTHENTICATED "invalid request signature") instead of the
hash gate (INVALID_ARGUMENT). Security is unchanged — both refusals happen
before the payload is handled. The four payload-hash unit tests re-sign
over the tampered hash so they keep exercising the hash gate; the
cross-service integration test signs over the overridden hash and already
accepts both codes.

Refs #39

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

gateway/internal/grpcapi/payload_hash_integration_test.go

@@ -27,6 +27,9 @@ func TestExecuteCommandRejectsPayloadHashWithInvalidLength(t *testing.T) {
 
 	req := newValidExecuteCommandRequest()
 	req.PayloadHash = []byte("short")
+	// Signature verification now precedes the payload-hash gate, so re-sign
+	// over the tampered hash to keep the signature valid and exercise the gate.
+	req.Signature = signRequest(req.GetProtocolVersion(), req.GetDeviceSessionId(), req.GetMessageType(), req.GetTimestampMs(), req.GetRequestId(), req.GetPayloadHash())
 
 	_, err := client.ExecuteCommand(context.Background(), connect.NewRequest(req))
 	require.Error(t, err)
@@ -51,6 +54,9 @@ func TestExecuteCommandRejectsPayloadHashMismatch(t *testing.T) {
 	req := newValidExecuteCommandRequest()
 	sum := sha256.Sum256([]byte("other"))
 	req.PayloadHash = sum[:]
+	// Signature verification now precedes the payload-hash gate, so re-sign
+	// over the tampered hash to keep the signature valid and exercise the gate.
+	req.Signature = signRequest(req.GetProtocolVersion(), req.GetDeviceSessionId(), req.GetMessageType(), req.GetTimestampMs(), req.GetRequestId(), req.GetPayloadHash())
 
 	_, err := client.ExecuteCommand(context.Background(), connect.NewRequest(req))
 	require.Error(t, err)
@@ -74,6 +80,9 @@ func TestSubscribeEventsRejectsPayloadHashWithInvalidLength(t *testing.T) {
 
 	req := newValidSubscribeEventsRequest()
 	req.PayloadHash = []byte("short")
+	// Signature verification now precedes the payload-hash gate, so re-sign
+	// over the tampered hash to keep the signature valid and exercise the gate.
+	req.Signature = signRequest(req.GetProtocolVersion(), req.GetDeviceSessionId(), req.GetMessageType(), req.GetTimestampMs(), req.GetRequestId(), req.GetPayloadHash())
 
 	err := subscribeEventsError(t, context.Background(), client, req)
 	require.Error(t, err)
@@ -98,6 +107,9 @@ func TestSubscribeEventsRejectsPayloadHashMismatch(t *testing.T) {
 	req := newValidSubscribeEventsRequest()
 	sum := sha256.Sum256([]byte("other"))
 	req.PayloadHash = sum[:]
+	// Signature verification now precedes the payload-hash gate, so re-sign
+	// over the tampered hash to keep the signature valid and exercise the gate.
+	req.Signature = signRequest(req.GetProtocolVersion(), req.GetDeviceSessionId(), req.GetMessageType(), req.GetTimestampMs(), req.GetRequestId(), req.GetPayloadHash())
 
 	err := subscribeEventsError(t, context.Background(), client, req)
 	require.Error(t, err)