Strict JSON HTTP API for the standalone Incant admin release.

The API exposes Incant's existing session contract over HTTP: service discovery, surface inspection, resource row/query reads, and declared action execution. JSON request contracts are decoded once at the boundary with JSONCodec; errors use RFC 9457 Problem Details.