feat: declare every protocol method's direction and enforce it in the router; add the zero-trust design [CI]

Methods, roles and binary channels are declared in one table per plane (node and peer). RpcRouter checks direction, kind and role when handlers are registered, when messages arrive (fleet_protocol_violation, disconnect after repeated violations) and before sending. NodeConnection is split by responsibility.

backend/agent/src/MoShiro.Agent/AgentApp.cs

@@ -16,7 +16,8 @@ public sealed class AgentApp : IDisposable
 
     private readonly AgentConfig _config;
     private readonly bool _ipv6Supported;
-    private readonly RestartController? _restart;
+    private readonly RestartController _restart;
+    private readonly RestartController? _ownedRestart;
     private readonly LoadedNodeIdentity _identity;
     private readonly TimeProvider _time;
     private readonly INodeLog _log;
@@ -40,7 +41,8 @@ public sealed class AgentApp : IDisposable
     /// <param name="dataDirectory">配置目录（容器里的 <c>/etc/moshiro</c>）：宿主机更新器和节点在这里交换清单、请求和状态。</param>
     public AgentApp(AgentConfig config, LoadedNodeIdentity identity, string dataDirectory, TimeProvider time, INodeLog log, RestartController? restart = null)
     {
-        _restart = restart;
+        _ownedRestart = restart is null ? new RestartController() : null;
+        _restart = restart ?? _ownedRestart!;
         _update = new UpdateBridge(dataDirectory, new ConfigStore(dataDirectory).Write, log);
         _config = config;
         _identity = identity;
@@ -102,7 +104,11 @@ public sealed class AgentApp : IDisposable
     /// <summary>数据面和控制端口都开始监听之后完成（配置里的端口为 0 时，这里能读到实际端口）。</summary>
     public Task Ready => _ready.Task;
 
-    public void Dispose() => _udp.Dispose();
+    public void Dispose()
+    {
+        _udp.Dispose();
+        _ownedRestart?.Dispose();
+    }
 
     internal StreamRegistry Streams => _streams;
 
@@ -116,6 +122,9 @@ public sealed class AgentApp : IDisposable
 
     public FleetLink Link => _link;
 
+    /// <summary>对等面（Probe 连进来的会话）的路由器，测试用。</summary>
+    public RpcRouter<PeerContext> PeerRouter => _hub.Router;
+
     /// <summary>期望状态里是否已经有这个 Probe 的公钥（测试用：握手会按它校验）。</summary>
     public bool IsPeerKnown(string probeId, string publicKeyBase64) =>
         _tasks.LookupPeerKey(probeId) is { } key && Convert.ToBase64String(key) == publicKeyBase64;
@@ -190,7 +199,7 @@ public sealed class AgentApp : IDisposable
 
     private FleetLink BuildLink()
     {
-        var router = new RpcRouter<LinkContext>();
+        var router = new RpcRouter<LinkContext>(RpcSide.Node, MoShiroMethodTable.Table, NodeRoles.Agent);
         HashSet<string>? allowed = _config.Policy.AllowMethods is { } list ? [.. list] : null;
         bool Allow(string method) => allowed is null || allowed.Contains(method);
 
@@ -221,7 +230,7 @@ public sealed class AgentApp : IDisposable
             });
         }
 
-        if (Allow(MoShiroMethods.Schedule) && _restart is not null)
+        if (Allow(MoShiroMethods.Schedule))
         {
             router.OnNotify(MoShiroMethods.Schedule, MoShiroJsonContext.Default.ScheduleParams, (_, schedule, _) =>
             {

backend/agent/src/MoShiro.Agent/Peer/PeerHub.cs

@@ -90,6 +90,9 @@ public sealed class PeerHub
     private readonly TimeProvider _time;
     private readonly INodeLog _log;
 
+    /// <summary>对等面入站方法的路由器（只读，测试用）。</summary>
+    public RpcRouter<PeerContext> Router => _router;
+
     public PeerHub(SessionRegistry sessions, MonoClock clock, ChunkAssembler chunks, TaskManager tasks, BackendUplink uplink, TimeProvider time, INodeLog log)
     {
         _router = BuildRouter();
@@ -272,7 +275,7 @@ public sealed class PeerHub
     }
 
     private static RpcRouter<PeerContext> BuildRouter() =>
-        new RpcRouter<PeerContext>()
+        new RpcRouter<PeerContext>(RpcSide.Listener, MoShiroMethodTable.Table)
             .On(
                 MoShiroMethods.Clock,
                 MoShiroJsonContext.Default.ClockParams,