feat: declare every protocol method's direction and enforce it in the router; add the zero-trust design [CI]

Methods, roles and binary channels are declared in one table per plane (node and peer). RpcRouter checks direction, kind and role when handlers are registered, when messages arrive (fleet_protocol_violation, disconnect after repeated violations) and before sending. NodeConnection is split by responsibility.

backend/probe/src/MoShiro.Probe/Link/AgentConnection.cs

@@ -25,6 +25,9 @@ public sealed class AgentConnection
     private static readonly TimeSpan s_clockInterval = TimeSpan.FromSeconds(30);
     private static readonly RpcRouter<ConnectionSession> s_router = BuildRouter();
 
+    /// <summary>对等面入站方法的路由器（只读，测试用）。</summary>
+    public static RpcRouter<ConnectionSession> Router => s_router;
+
     private readonly ConnectionEnv _env;
     private volatile ConnectionSession? _session;
 
@@ -191,7 +194,7 @@ public sealed class AgentConnection
     }
 
     private static RpcRouter<ConnectionSession> BuildRouter() =>
-        new RpcRouter<ConnectionSession>()
+        new RpcRouter<ConnectionSession>(RpcSide.Dialer, MoShiroMethodTable.Table)
             .On(
                 FleetMethods.StateSync,
                 FleetRpcContext.Default.StateSyncParams,

backend/probe/src/MoShiro.Probe/ProbeApp.cs

@@ -50,7 +50,7 @@ public sealed class ProbeApp : IDisposable
                 directory.Apply(doc);
                 return ValueTask.FromResult(new StateSyncResult { AppliedVersion = version });
             });
-        var router = new RpcRouter<LinkContext>()
+        var router = new RpcRouter<LinkContext>(RpcSide.Node, MoShiroMethodTable.Table, NodeRoles.Probe)
             .OnNotify(MoShiroMethods.UpdateOffer, MoShiroJsonContext.Default.UpdateOfferParams, (_, offer, _) =>
             {
                 update.WriteOffer(offer);