feat: declare every protocol method's direction and enforce it in the router; add the zero-trust design [CI]

Methods, roles and binary channels are declared in one table per plane (node and peer). RpcRouter checks direction, kind and role when handlers are registered, when messages arrive (fleet_protocol_violation, disconnect after repeated violations) and before sending. NodeConnection is split by responsibility.

backend/fleet/src/Fleet.Core/ErrorCode.cs

@@ -13,6 +13,8 @@ public static class FleetErrors
     public static readonly ErrorCode Unauthorized = new("fleet_unauthorized");
     public static readonly ErrorCode Forbidden = new("fleet_forbidden");
     public static readonly ErrorCode Unsupported = new("fleet_unsupported");
+    /// <summary>方法没有声明、方向不对、类型不对或角色不允许：对方违反了协议。</summary>
+    public static readonly ErrorCode ProtocolViolation = new("fleet_protocol_violation");
     public static readonly ErrorCode InvalidParams = new("fleet_invalid_params");
     public static readonly ErrorCode NotFound = new("fleet_not_found");
     public static readonly ErrorCode Internal = new("fleet_internal");