Add generic service channel publication

[edwin-zvs]

Summary

• add a provider-neutral channel publication supervisor around typed local ingress endpoints
• keep channel parsing, caller authentication, and session routing inside channel adapters
• add the first-party Construct backend with owner OAuth, scoped registration, reverse transport, readiness, retry, and typed public endpoint validation
• expose explicit publish/unpublish RPCs in the client, TUI, and WebTUI
• withdraw publication on pause, disable, detach, listener loss, endpoint replacement, or daemon restart without auto-republishing
• document the durable architecture boundary and operator workflow

The boundary is intentionally not HTTP-shaped: HTTP and WebSocket profiles return URLs with canonical paths, opaque TCP profiles return host/port endpoints, and UDP or outbound channels can opt in or out according to provider capabilities.

Gateway rollout dependency

The client/daemon implementation is complete, but production use requires matching gateway support for:

• POST https://tunnel.zarvis.ai/api/v1/channel-publications
• registration by installation id plus globally exclusive channel id, transport, protocol profile/path, and authorization: "channel"
• preserving the caller's channel Authorization header and request body end to end
• returning a typed public endpoint, relay URL/port, scoped tunnel token, readiness URL, expiry, and optional re-registration token
• returning HTTP public URLs that include the channel's canonical path

The existing remote-control tunnel remains a separate route and lifecycle. This PR is draft until that gateway contract is deployed.

Verification

• cargo check --workspace
• cargo test -p construct-daemon --lib (518 passed)
• focused publication lifecycle, canonical-path, notification-forwarding, listener-rebind, and TUI rendering tests
• WebTUI inline JavaScript syntax validation
• cargo build --workspace --bins
• full CLI suite reached 1305/1306 before the final main rebase; the only failure is the pre-existing color::tests::truecolor_backend_still_emits_rgb test, which also fails in isolation on this terminal backend and is unrelated to this diff

No recording is attached because the production gateway endpoint needed to reach the Ready state is not deployed.

[edwin-zvs]

Gateway implementation: https://github.com/zarvis-ai/construct-service/pull/12. The first-party backend now advertises HTTP-over-TCP only, matching the deployed edge; the generic publication boundary still models future WebSocket and opaque transports.