test(gateway): publish mobile contract conformance

[ericlewis]

Summary

• add one generic FastAPI + real WebSocket conformance path for the Mobile Client Contract
• authenticate through the configured dashboard flow, mint a fresh scoped ticket for every connection, and validate the effective gateway.ready grant
• prove an unread prompt ACK recovers through cursor resume and same-ID retry with exactly one persisted user turn
• prove an unread approval request recovers with the same Hermes identity, resolves once, and replays one stable durable result
• prove replay complete, gap/replay_evicted, reset/stream_changed, and reset/server_instance_changed
• publish the normative custom-client contract in Programmatic Integration, with the internal contract file reduced to implementation notes

Public-boundary proof

The conformance test keeps the real FastAPI route, dashboard authentication, single-use ticket consumption, WebSocket transport, dispatcher, lazy session-row creation, prompt runner, AIAgent.run_conversation, turn-context persistence, SessionDB flushing, synchronization stream, durable mutation store, and approval core. Only the external model-provider response is deterministic.

The client intentionally disconnects without consuming the prompt ACK and later without consuming approval.request; both are recovered on fresh authenticated WebSockets.

Stack / review order

This final conformance/docs slice is stacked on the integrated approval PR #63197, which itself combines:

1. feat(gateway): negotiate scoped WebSocket grants #62858 — versioned hello and scoped WebSocket grants
2. feat(gateway): add revisioned conversation sync #63149 — revisioned snapshots and replay
3. feat(gateway): persist mobile mutation receipts #63190 — durable mobile mutation receipts

Cuttle tracking: https://github.com/ericlewis/cuttle/issues/6
Parent contract: https://github.com/ericlewis/cuttle/issues/1

Validation

• conformance test passed 5 consecutive real-path runs
• 62 passed — complete authenticated WebSocket test file
• 204 passed — relevant auth/ticket/hello/sync/mutation/approval suite
• Ruff passed
• git diff --check passed
• Docusaurus English production build passed; only unrelated pre-existing broken-link/anchor warnings remain
• independent Standards and Spec reviews completed with no remaining findings