feat: add Direct WSS provisioning

[twilightsaurus]

Summary

Adds supported provisioning and onboarding for the existing authenticated Direct WSS transport.

• adds imp-direct-wss setup|rotate|status
• securely generates canonical pairing tokens and persists only their SHA-256 digest
• adds private atomic gateway configuration and mutation locking
• makes setup idempotent and rotation explicit
• verifies local gateway health plus authenticated protocol-v2 readiness
• preserves inactive/enabled gateway state during rotation
• adds bounded rollback for handled provisioning failures
• installs a stable imp-direct-wss command through the server bundle
• preserves Direct-WSS-default-off installation behavior
• preserves gateway credentials and service state across reinstall/upgrade
• improves Direct onboarding/help text and deployment documentation
• adds bounded public endpoint verification guidance

Security and architecture

Unchanged:

• relay remains loopback-only
• gateway remains loopback-only
• public TLS terminates outside Imp
• /ingest and /action-consumer remain unavailable through the gateway
• protocol v2 is unchanged
• SSH behavior is unchanged
• desktop credential persistence is unchanged
• plaintext pairing tokens are never persisted server-side

Validation

Independent implementation review: approved after remediation.

Full repository gate passed:

• Protocol: 64 passed
• Desktop: 152 passed
• Relay: 288 passed
• Shared adapter: 31 passed
• Mudlet: 32 passed
• TinyFugue: 101 passed
• lint / formatting / typing: passed
• cross-component E2E: passed
• production build: passed

Server-bundle acceptance passed using real relay/gateway processes with simulated systemd.

Focused verifier acceptance passed against disposable local TLS infrastructure.

Live acceptance

Real user-systemd, public-CA TLS, Windows Direct mode, live MUD action delivery, credential rotation, and released-artifact reinstall/upgrade acceptance remain intentionally pending.

Those checks require the released artifact produced after this PR merges. No live VPS, desktop, credential, or public endpoint was modified during the pre-merge acceptance pass.