perf(app-server): move TypeScript schema generation to protocol owner

[limityan]

Summary

• consolidate legacy App Server wire DTOs and TypeScript exports under bitfun-app-server-protocol
• keep Runtime/Core/service conversions in private App Server adapters and remove the duplicate hidden server client
• make Web API generation clean and rebuild the protocol-owned output deterministically
• update ownership documentation and extend the existing boundary guard without adding CI jobs

Why

gen:types previously compiled both the protocol crate and the full App Server handler/runtime graph. In one recent Frontend Build sample, type generation occupied about 430s of a 484s build:web step. This identifies a compilation hotspot; it is not presented as a guaranteed wall-clock improvement.

Architecture and compatibility

• bitfun-app-server-protocol remains behavior-light and does not depend on Core, Agent Runtime, or Services implementations.
• Runtime/domain-to-wire and wire-to-runtime conversion stays in App Server or CLI adapter code. Host policy remains explicit: Desktop UI on the server path and CLI on the Shared TUI path.
• agent/submitDialogTurn now has one canonical request type; the legacy message name is an alias of that same wire contract.
• bitfun_app_server::schema preserves flat type paths and wire shapes as an internal compatibility re-export. Removed server-only inherent conversion helpers are not represented as a versioned public SDK guarantee.
• No JSON-RPC method, protocol version, transport, authentication, or capability behavior is changed.
• .github/** is unchanged; no workflow or job was added.

Dependency impact

TypeScript export closure	Before	After	Reduction
Windows	433	153	280
macOS	429	159	270
Linux	437	159	278

Cargo.lock keeps 1,159 package records with no additions, removals, upgrades, or downgrades. Only four direct dependency edges leave the bitfun-app-server package record: bitfun-events, futures, tokio-util, and ts-rs.

Validation

• protocol legacy wire contracts: 3/3
• App Server wire adapter tests: 4/4
• App Server agent kernel tests: 15/15
• protocol/client/server and CLI focused checks
• 100 request methods and 6 notification methods with no duplicate method ownership
• generated bindings: 19 direct Web imports and a 30-file recursive closure, byte-identical to the pre-refactor baseline
• stale generated binding injection is removed by the new clean generation path
• core boundary tests: 120/120, plus the live boundary checker
• repository hygiene, locked metadata, Web type-check, and diff checks
• two independent adversarial review rounds: no remaining P0-P3 findings