feat: declare every protocol method's direction and enforce it in the router; add the zero-trust design [CI]

Methods, roles and binary channels are declared in one table per plane (node and peer). RpcRouter checks direction, kind and role when handlers are registered, when messages arrive (fleet_protocol_violation, disconnect after repeated violations) and before sending. NodeConnection is split by responsibility.

backend/agent/src/MoShiro.Agent/Peer/PeerHub.cs

@@ -90,6 +90,9 @@ public sealed class PeerHub
     private readonly TimeProvider _time;
     private readonly INodeLog _log;
 
+    /// <summary>对等面入站方法的路由器（只读，测试用）。</summary>
+    public RpcRouter<PeerContext> Router => _router;
+
     public PeerHub(SessionRegistry sessions, MonoClock clock, ChunkAssembler chunks, TaskManager tasks, BackendUplink uplink, TimeProvider time, INodeLog log)
     {
         _router = BuildRouter();
@@ -272,7 +275,7 @@ public sealed class PeerHub
     }
 
     private static RpcRouter<PeerContext> BuildRouter() =>
-        new RpcRouter<PeerContext>()
+        new RpcRouter<PeerContext>(RpcSide.Listener, MoShiroMethodTable.Table)
             .On(
                 MoShiroMethods.Clock,
                 MoShiroJsonContext.Default.ClockParams,