feat(rate): add Morris authority bridge

[d-sorgcodexagent]

Summary

• define strict versioned Morris request and job/result envelopes over stable primitives
• provide the sole UI-neutral Python Rate Morris service authority
• add a bounded mountable FastAPI job router with create/status/cancel, lock-linearized cancellation, retention limits, strict raw JSON, and sanitized errors
• add strict TypeScript envelope parsing and an injected transport client with no browser-physics fallback
• update SPEC 1.16.28 and all three canonical Rate handoffs

Verification

• 45 focused authority and prior adapter tests
• 60 Rate variation tests
• 136 shared variation tests
• 7 TypeScript contract/client tests
• TypeScript type-check, zero-warning ESLint, and Vite production build
• Ruff/format and hosted-style MyPy
• import, diff, secrets, file/function/signature budgets
• independent review found and verified closure of two DbC-off wire-validation P1s; final review GO

Scope boundary

This child is a mountable authority bridge only. It does not register a production host, change CORS, add PyQt/React presentation, export, persistence, or UpstreamDrift consumption. The genuine fixed double-pendulum hit fixture and higher-fidelity contact physics remain open.

Tracks #4142
Tracks #4144