feat(server): register standard gRPC reflection on the primary listener

先从 /grpc.reflection. 的身份验证绕过以及涵盖主 listener 和仅 callback listener 的 listener 测试开始，然后检查 openshell_core::FILE_DESCRIPTOR_SET 和 gateway server 注册入口。使用正在运行的 gateway 和 reflection client 验证 reflection service 的行为，包括预期的 services、身份验证以及对 callback listener 的拒绝。最后添加所请求的 grpcurl 文档，同时将 #2569 中的 health service 工作分开。

User Story

As an API developer or operator, I want the gateway to serve standard gRPC reflection on its primary listener, so that supported tools can discover services and message descriptors without a separately distributed descriptor file.

Problem Statement

The gateway authentication and listener-routing code recognizes gRPC reflection paths as unauthenticated on the primary listener, and the build already produces a complete descriptor set. The server does not register a standard reflection service, so requests routed through that exception reach no implementation.

Impact / Why This Matters

Tools such as grpcurl, schema browsers, and integration diagnostics cannot discover the live gateway API. The existing unauthenticated routing rule suggests reflection is supported when it is not. Developers must locate matching source protos or descriptor artifacts and ensure they correspond to the running gateway version.

Proposed Design

Register the standard gRPC reflection v1 service on the primary gateway listener using the descriptor set produced by the existing protobuf build. Reflection remains unavailable on callback-only listeners and follows the existing unauthenticated primary-listener policy.

Expose all intentionally discoverable public services while excluding any service that is not actually routed by that listener. Document the security and deployment behavior.

Acceptance Criteria

• Standard gRPC reflection v1 is served on the primary listener.
• Reflection returns descriptors for every intentionally discoverable service routed by that listener.
• Callback-only listeners reject reflection using their existing protocol-appropriate response.
• Reflection does not require OIDC or mTLS user authentication on the primary listener, matching the documented policy.
• An integration test uses a reflection client against a running gateway and enumerates expected services.
• Documentation includes a minimal grpcurl discovery example and explains listener/auth behavior.
• Standard health service work remains independently tracked in #2569.

Alternatives Considered

Remove reflection from the unauthenticated routing allowlist and distribute descriptor files only. This avoids serving reflection but provides a poorer diagnostics workflow and requires artifact/version coordination. Implement a custom schema endpoint. Standard reflection already has broad tooling support and avoids another OpenShell-specific contract.

Agent Investigation

The auth bypass includes /grpc.reflection., listener tests expect reflection on the primary listener and reject it on callback-only listeners, and openshell_core::FILE_DESCRIPTOR_SET contains the compiled descriptors. No reflection service dependency or registration is present.

Related: #2565, #2569. Source audit: https://gist.github.com/mrunalp/e80942c1544a0225ee588796a41ab30b.