test: unify gateway integration architecture

[lucarlig]

Summary

• Consolidate the nine library integration binaries into one feature-organized gateway target.
• Replace duplicate gateway and backend setup with pre-bound, lifecycle-owned HTTP and TLS fixtures.
• Preserve all 13 ignored tests while modernizing the 11 library future contracts to MCP 2026-07-28 and server/discover.
• Isolate active compatibility coverage and remove duplicate concrete secrets-plugin gateway tests.
• Update the testing wiki with the new lanes, inventory, fixture model, and ignored-test policy.

Architecture

• Add Gateway::into_router() as the public composition seam.
• Add owned TestServer and GatewayFixture primitives with cancellation, explicit async shutdown, and Drop fallback.
• Default fixtures to one virtual host and the minimum backend count.
• Keep focused Counter, Recording, Paginating, plaintext, and TLS backends instead of a generic mock DSL.
• Remove openport usage from the library suite, readiness polling, global port locking, unowned spawns, manual abort boilerplate, and dead support helpers.

Inventory

• Before: 219 active tests, 13 ignored tests, 10 library integration binaries.
• After: 214 active tests, 13 ignored tests, 2 library integration binaries.
• The five removed active cases duplicated concrete secrets-plugin behavior already owned by the plugin crate; deterministic recording-plugin gateway coverage remains.

Verification

• cargo fmt --all --check
• cargo clippy --locked --workspace --all-targets --all-features -- -D warnings
• cargo test --locked --workspace --all-features --no-run
• cargo nextest run --locked --workspace --all-features --no-fail-fast: 214 passed, 13 skipped
• cargo shear --check-test-targets --deny-warnings --locked
• mdbook build _context/wiki
• mdbook test _context/wiki

The ignored-only lane was also run with no fail-fast. All 13 remain expected failures: nine federated fanout or control-plane contracts, one missing prompt-completion capability, one cancellation contract timeout, and two Redis process E2Es that require redis-server. The ignored TLS scenario now reaches its known federated-list blocker instead of failing during fixture setup.

Non-goals

• No production compatibility removal.
• No ignored-test deletion or enablement.
• No conformance CI changes; PR ci: centralize conformance in cf-integration #123 owns that lane.
• Pre-2026 compatibility cleanup remains a later product PR.