grpc-gateway HTTP/JSON surface

Nobody has claimed this yet.

## Goal

Expose flintlock's REST/JSON gateway surface in addition to gRPC, so HTTP clients can drive Brigade.

## Context

flintlock's proto carries grpc-gateway annotations (`google.api.http`, openapiv2). Brigade day-1 is **gRPC-only**: the codegen input under `proto/` has those annotations stripped (wire-identical), and the pristine upstream copies with annotations are kept in `proto/vendor/`.

## Scope

- Restore/generate the gateway from the vendored annotated protos.
- Run the HTTP/JSON gateway (separate port) mapping to the gRPC service.
- Apply the same north-edge auth interceptor equivalent to the HTTP path.

## Security note

The grpc hex advisory **CVE-2026-48599** (auth bypass via path binding override) is in the HTTP transcoding path. It is currently inactive because Brigade runs gRPC only. **Enabling the gateway activates that surface** — must be addressed (patched grpc version / mitigation) before shipping this.

Deferred from the M0–M4 build.

Start by comparing the annotated protos in proto/vendor/ with the stripped codegen input under proto/, then trace how the existing gRPC service and north-edge auth interceptor are wired. Review the grpc hex CVE-2026-48599 before enabling HTTP transcoding. Done means a generated gateway runs on a separate port, maps to gRPC, preserves auth, and has the advisory addressed before shipping.

Written by the indexing model from the issue text.