feat: remove public REST API; route all app calls over WebSocket RPC

The platform no longer exposes a public /api/* REST surface. The original
HTTP route handlers are preserved verbatim as the single source of truth
inside an internal, never-socket-bound FastAPI app (rpc_app), and are now
reached only via RPC-over-WebSocket dispatch.

- realtime router: anonymous connections allowed only to /api/auth/login
  and /api/auth/signup; all other RPCs/subscribes refused until token auth.
- RPC dispatch re-injects the bearer token and X-Request-ID, then forwards
  through httpx.ASGITransport against the internal app (no network hop).
- Public app now serves only /, /health, /health/ready and /api/ws;
  docs/openapi disabled.
- Frontend: apiRequest routes /api/* to ws.rpc(); /health probes keep fetch.
  RealtimeClient gains rpc() with id correlation, timeout and AbortSignal.
- Tests repointed to get_rpc_app(); anonymous-auth behaviour covered.

Result: zero REST on the public surface; 264 backend tests + frontend
typecheck pass.

packages/contracts/src/index.ts

@@ -711,18 +711,31 @@ export interface WsEvent<T = Record<string, unknown>> {
 
 /** Every frame the server sends. Control frames and events share ``type``. */
 export type WsServerFrame =
-  | { type: "hello"; user_id: string; server_time: string }
+  | { type: "hello"; user_id: string | null; server_time: string }
   | { type: "subscribed"; accepted: string[]; rejected: string[] }
   | { type: "unsubscribed"; channels: string[] }
   | { type: "pong" }
   | { type: "error"; message: string }
-  | { type: "event"; event: WsEvent };
+  | { type: "event"; event: WsEvent }
+  /** Reply to a client ``rpc`` frame: the HTTP status and parsed JSON body of the
+   *  internal dispatch, correlating on ``id``. */
+  | { type: "rpc_result"; id: string; status: number; body: unknown };
 
 /** Every frame the client may send. */
 export type WsClientFrame =
   | { action: "subscribe"; channels: string[] }
   | { action: "unsubscribe"; channels: string[] }
-  | { action: "ping" };
+  | { action: "ping" }
+  /** A request/response call into the server. ``id`` correlates the
+   *  ``rpc_result``; ``path`` is the full mounted path including any query
+   *  string. Every application call travels over this frame. */
+  | {
+      action: "rpc";
+      id: string;
+      method: "GET" | "POST" | "PATCH" | "PUT" | "DELETE";
+      path: string;
+      body: unknown;
+    };
 
 /** Live run-step payload — what the task timeline renders as it arrives. */
 export interface WsRunStepData {