HTTP fallback leg (docs/19): POST /v1/frame + SSE /v1/events + long-poll

Second, short-lived-connection transport next to the WS: same frames,
same outbox/cursor, same token, served over plain HTTP (stdlib
ThreadingHTTPServer bridged into the asyncio loop; zero new deps).

- http_server.py: /v1/health (unauthenticated), POST /v1/frame
  (accept-and-ack; validation rejections as 4xx error frames), SSE
  /v1/events (outbox catch-up with id=cursor, event: hello, 15s
  heartbeat, bounded-queue backpressure), long-poll /v1/poll (25s hold).
  Bearer token + X-Iris-Device (same allowlist as WS hello), 64 KiB body
  cap, per-device rate limit, optional TLS, non-fatal bind failure.
- ws_server.py: inbound dispatch chain extracted to shared
  dispatch_frame() used by both transports.
- adapter.py: ANDROID_HTTP_PORT/CERT/KEY config; start/stop next to the
  WS; delivery counting in _broadcast_or_log (an SSE subscriber is a
  live subscriber -> no push, docs/19 19.8); _reply() routes
  point-to-point replies into the in-flight HTTP response (reply sink)
  or broadcasts when the device has no live WS (19.7); status/typing/
  channel events fan out to both transports.
- ws_probe.py: --http mode (health + POST + SSE turn drive, same
  assertion flags); tests/README updated.
- Tests: hermes-agent/tests/gateway/test_android_http.py (23 tests,
  incl. the 19.8 delivery-counting regression); test_android.py (74)
  still green.

gateway-plugin/tests/README.md

@@ -43,6 +43,12 @@ Beyond the base modes (`--send`, `--upload`, `--pull-offer`, `--sync`,
 - `--offer-grace S` — with `--pull-offer`, keep listening S seconds after
   the final message for a `media.offer` (offers are emitted post-turn,
   right after the final; default 15).
+- `--http [--http-url http://host:port]` — docs/19: drive the turn over
+  the **HTTP fallback leg** instead of WS: `GET /v1/health`,
+  `POST /v1/frame` (the `message.send`), receive over SSE `GET
+  /v1/events`. The same assertion flags apply. The base URL defaults to
+  the `--url` host with scheme `ws(s)` → `http(s)` and port 8791
+  (`ANDROID_HTTP_PORT`).
 
 Exit codes: `0` ok (incl. SKIP for absent M7 frames), `2` connect fail,
 `3` no hello.ack, `4` expected hello.ack, `5` authfail expected but
@@ -51,7 +57,9 @@ acked, `6` timeout, `7` no final message, `8` upload/sync fail,
 `12` assert-tools fail, `13` assert-commentary fail, `14` search fail
 (error or zero hits), `15` channel.create/list fail, `16` channel.delete
 fail, `17` watch timeout, `18` read.receipt arrived before the sent
-message, `19` status frame with empty payload.
+message, `19` status frame with empty payload, `20` `--http` health
+check failed, `21` `--http` SSE open failed, `22` `--http`
+`POST /v1/frame` rejected (4xx).
 
 ## E2E driver (`e2e.py`)