feat(server): register standard gRPC reflection on the primary listener

User Story

As an API developer or operator, I want the gateway to serve standard gRPC reflection on its primary listener, so that supported tools can discover services and message descriptors without a separately distributed descriptor file.

Problem Statement

The gateway authentication and listener-routing code recognizes gRPC reflection paths as unauthenticated on the primary listener, and the build already produces a complete descriptor set. The server does not register a standard reflection service, so requests routed through that exception reach no implementation.

Impact / Why This Matters

Tools such as grpcurl, schema browsers, and integration diagnostics cannot discover the live gateway API. The existing unauthenticated routing rule suggests reflection is supported when it is not. Developers must locate matching source protos or descriptor artifacts and ensure they correspond to the running gateway version.

Proposed Design

Register the standard gRPC reflection v1 service on the primary gateway listener using the descriptor set produced by the existing protobuf build. Reflection remains unavailable on callback-only listeners and follows the existing unauthenticated primary-listener policy.

Expose all intentionally discoverable public services while excluding any service that is not actually routed by that listener. Document the security and deployment behavior.

Acceptance Criteria

• Standard gRPC reflection v1 is served on the primary listener.
• Reflection returns descriptors for every intentionally discoverable service routed by that listener.
• Callback-only listeners reject reflection using their existing protocol-appropriate response.
• Reflection does not require OIDC or mTLS user authentication on the primary listener, matching the documented policy.
• An integration test uses a reflection client against a running gateway and enumerates expected services.
• Documentation includes a minimal grpcurl discovery example and explains listener/auth behavior.
• Standard health service work remains independently tracked in #2569.

Alternatives Considered

Remove reflection from the unauthenticated routing allowlist and distribute descriptor files only. This avoids serving reflection but provides a poorer diagnostics workflow and requires artifact/version coordination. Implement a custom schema endpoint. Standard reflection already has broad tooling support and avoids another OpenShell-specific contract.

Agent Investigation

The auth bypass includes /grpc.reflection., listener tests expect reflection on the primary listener and reject it on callback-only listeners, and openshell_core::FILE_DESCRIPTOR_SET contains the compiled descriptors. No reflection service dependency or registration is present.

Related: #2565, #2569. Source audit: https://gist.github.com/mrunalp/e80942c1544a0225ee588796a41ab30b.

Start with the authentication bypass for /grpc.reflection. and the listener tests that cover primary and callback-only listeners, then inspect openshell_core::FILE_DESCRIPTOR_SET and the gateway server registration entry point. Verify reflection service behavior with a running gateway and reflection client, including expected services, authentication, and callback-listener rejection. Finish by adding the requested grpcurl documentation while keeping health service work in #2569 separate.