feat(appservice): mosaic-as daemon host + container (M4a deploy prep, agent-comms#9)

apps/appservice: framework-agnostic node:http daemon hosting
@mosaicstack/appservice — Synapse transactions endpoint passthrough,
internal bridge API v1 (messages/typing) with HMAC-digest timing-safe
bearer tokens, 1MiB request body cap, explicit 405 inside the
authenticated bridge block (no fall-through around auth), health endpoint,
env config, registration YAML printer bin. docker/appservice.Dockerfile
mirrors the gateway multi-stage pnpm/turbo pattern, runs as USER node
with container healthcheck. 9 vitest tests.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

apps/appservice/package.json

@@ -0,0 +1,35 @@
+{
+  "name": "@mosaicstack/mosaic-as",
+  "version": "0.0.1",
+  "type": "module",
+  "private": true,
+  "repository": {
+    "type": "git",
+    "url": "https://git.mosaicstack.dev/mosaicstack/stack.git",
+    "directory": "apps/appservice"
+  },
+  "main": "dist/main.js",
+  "bin": {
+    "mosaic-as": "dist/main.js",
+    "mosaic-as-registration": "dist/registration-main.js"
+  },
+  "scripts": {
+    "build": "tsc",
+    "lint": "eslint src",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run --passWithNoTests",
+    "dev": "tsx watch src/main.ts"
+  },
+  "dependencies": {
+    "@mosaicstack/appservice": "workspace:*"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "tsx": "^4.19.0",
+    "typescript": "^5.8.0",
+    "vitest": "^2.0.0"
+  },
+  "files": [
+    "dist"
+  ]
+}