Add Fission Developer SDK and declarative protected routes

[zcourts]

This change adds the public application-worker boundary for Fission Developer and completes the host-side attachment path needed for development tools to discover, authenticate to, scope, and observe a running application. The new fission-devtools crate keeps the worker contract renderer-independent: an application supplies its build, dispatch, snapshot, and restore behavior, while the resident developer host owns the shell and presentation surface. The inbox example demonstrates the separate development-worker entry point without changing its ordinary desktop binary.

Developer sessions are published through owner-restricted descriptors containing a per-session bearer capability. DeveloperSessionClient discovers the session for a project, connects through the authenticated loopback control endpoint, and scopes testing operations and screenshots to the application surface rather than the surrounding Developer UI. Reload observation reports whether a candidate generation activated or was rejected while the active generation remained available.

The routing portion adds ProtectedRoute, a declarative wrapper intended for use directly inside Router route builders. It accepts RouteDecision::Pending, Allow, Deny, or Redirect, lazily builds only the selected branch, preserves the existing router and route-handler mechanisms, and supports replacement or push-history redirects with an encoded return destination. For example:

Router::<AppState>::new()
    .with_path(view.state().current_path.clone())
    .route_component("/account", ProtectedRoute::new(
        decision,
        AccountRoute,
    ))
    .route_component("/sign-in", SignInRoute)

Native Web and desktop shells turn redirect outcomes into the normal Fission navigation effect. Terminal rebuilds after applying the route change. SSR returns a non-cacheable 302 Found for redirects and 403 Forbidden for denied content, preventing protected output from entering route caches. Static generation emits a canonical redirect page rather than protected content. The reference documentation describes the decision model, lazy branch behavior, async store-backed authorization flow, return destinations, and shell-specific behavior.