fix(server): reject HTTP turn bootstrap clearly

[yashranaway]

What Changed

• add a dedicated HTTP orchestration command schema
• exclude WebSocket-only turn bootstrap metadata from the HTTP contract
• reject bootstrap requests during payload validation instead of in the handler
• cover the HTTP schema boundary with an authenticated integration test

Why

The HTTP endpoint advertised the full WebSocket command contract even though bootstrap execution only exists on the WebSocket route. A transport-specific command schema keeps support decisions in the contract and avoids a growing list of handler conditionals.

Closes #8319.

Testing

• vp test run apps/server/src/server.test.ts --testNamePattern="rejects WebSocket-only turn bootstrap at the HTTP schema"
• vp test run packages/contracts/src/environmentHttp.test.ts
• vp lint packages/contracts/src/orchestration.ts packages/contracts/src/environmentHttp.ts apps/server/src/orchestration/http.ts apps/server/src/server.test.ts
• vp run --filter @t3tools/contracts typecheck
• vp run --filter t3 typecheck

Checklist

• HTTP transport support is represented in contracts
• WebSocket bootstrap behavior is unchanged
• targeted tests, lint, and typechecks pass
• rebased onto latest upstream main

Model: GPT-5.6 Sol
Harness: Codex in T3 Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: cb7dfb64-4715-4d8f-969f-2a931fbf6c48

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Approved at 3237dfa

Macroscope's review found this PR approvable — This is a narrow server validation fix that cleanly separates HTTP commands from WebSocket-only bootstrap commands and preserves existing valid request paths. The regression test verifies that unsupported HTTP bootstrap requests fail with a clear 400 response.

^{You can add or adjust custom eligibility rules. Learn more.}

[juliusmarminge]

this is the wrong layer to do this in. there's prob many commands that are not handled over HTTP, a big inline if statement for each is not scalable

[yashranaway]

Moved HTTP transport support into a dedicated command schema so the handler no longer needs transport-specific conditionals.

Dismissing prior approval to re-evaluate 3237dfa