[OoP-6] REST Client Codegen Wiring

[mattgarmon]

Parent: OoP

Blocked by: OoP-4

Description

Wire DirectoryService endpoint resolution into the existing trait-first codegen pipeline so generated REST clients auto-resolve via ClientHub.

PRD: cpt-cf-fr-client-transparency, cpt-cf-fr-direct-communication, cpt-cf-fr-rest-client-gen
Design: cpt-cf-component-rest-client-gen (trait-first codegen rationale + wiring portion)
ADR: — (no ADR; design captured in DESIGN.md cpt-cf-component-rest-client-gen)
Prerequisite / integration: the trait-first contract macros (#[toolkit::rest_contract] / #[toolkit::grpc_contract]) are delivered by PR #4084 (crates libs/toolkit-contract{,-macros,-protogen}). Reviewed: the macro generates an XxxRestClient over ::toolkit_http::HttpClient that forwards the bearer from the #[secctx] parameter as the authorization header — exactly what this phase needs (and ADR-0008-compliant: no x-secctx-bin over HTTP). Caveats: (a) the PR is still an OPEN PoC, so it must be integrated first; (b) naming is mixed modkit/toolkit and should be reconciled; (c) client codegen is solid but server-route generation is still partial (gears keep registering routes via OperationBuilder — fine here). Until #4084 lands, OoP-6 (and the client-dependent parts of OoP-8) remain blocked. No codegen is authored in this epic beyond integration + wiring.
Effort: Small (post-integration) — wires OoP endpoint resolution into the codegen from #4084

Tasks

• 6.1 Connect DirectoryService resolution to ApiContractsConfig.remote_endpoints:
  • When a dep is resolved via DirectoryService, populate the remote endpoint config
• 6.2 ClientHub auto-wiring: create RestXxxClient with resolved endpoint, register in ClientHub
• 6.3 Verify SecurityContext propagation in generated clients — assert the generated client forwards the bearer from the #[secctx] parameter via the authorization header (per PR feat(modkit-contract): add PoC contract stack for REST and gRPC #4084)
• 6.4 Test: gear A resolves gear B via DirectoryService, gets a typed REST client from ClientHub, makes a call with SecurityContext intact

Acceptance Criteria

• client_hub.get::<dyn GearBApi>() returns a working REST client resolved via DirectoryService
• SecurityContext round-trips through the generated client