feat: declare every protocol method's direction and enforce it in the router; add the zero-trust design [CI]

Methods, roles and binary channels are declared in one table per plane (node and peer). RpcRouter checks direction, kind and role when handlers are registered, when messages arrive (fleet_protocol_violation, disconnect after repeated violations) and before sending. NodeConnection is split by responsibility.

backend/fleet/src/Fleet.Server.Link/FleetLinkHost.cs

@@ -33,6 +33,7 @@ public sealed class FleetLinkHost : IFleetConnections, IStateNotifier
         Inboxes = inboxes.ToDictionary(i => i.Channel);
         Sinks = [.. sinks];
         Router = router.Inner;
+        RoleOf = router.RoleOf;
     }
 
     internal IFleetStore Store { get; }
@@ -51,6 +52,8 @@ public sealed class FleetLinkHost : IFleetConnections, IStateNotifier
 
     internal RpcRouter<NodeCallContext> Router { get; }
 
+    internal Func<NodeRecord, string?>? RoleOf { get; }
+
     public IReadOnlyCollection<NodeId> OnlineNodes => [.. _connections.Keys];
 
     public bool IsOnline(NodeId node) => _connections.ContainsKey(node);
@@ -161,10 +164,18 @@ public sealed class FleetLinkHost : IFleetConnections, IStateNotifier
 /// <summary>产品注册的 RPC 方法路由。</summary>
 public sealed class FleetRouter
 {
-    public FleetRouter(RpcRouter<NodeCallContext> inner)
+    public FleetRouter(RpcRouter<NodeCallContext> inner, Func<NodeRecord, string?>? roleOf)
     {
         Inner = inner;
+        RoleOf = roleOf;
     }
 
     internal RpcRouter<NodeCallContext> Inner { get; }
+
+    internal Func<NodeRecord, string?>? RoleOf { get; }
+
+    /// <summary>已注册的入站方法名（只读，测试用它核对声明表）。</summary>
+    public IReadOnlyCollection<string> Methods => Inner.Methods;
+
+    public MethodTable Table => Inner.Table;
 }