http: extract _run_http_exchange_turn + _mint_continuation_token

Pull the lockstep exchange dispatch out of ``_run_stream_exchange_sync``
into ``_run_http_exchange_turn``, mirroring the producer-side helper
``_run_http_producer_turn``.  The dispatcher is now a thin three-way
router (cancel / producer-continuation / exchange-turn); each branch
consists of the telemetry shell plus a delegate call.

Also extract ``_mint_continuation_token`` in ``_state_token.py``: the
five-line ``_serialize_state_bytes`` + two ``schema.serialize().to_pybytes()``
+ ``_pack_state_token`` block was duplicated across:

* ``_run_stream_init_sync`` — exchange-stream init token mint.
* ``_run_http_producer_turn`` — producer continuation token mint.
* ``_run_http_exchange_turn`` (formerly inline) — exchange continuation
  token mint.

The helper takes ``(state, state_info, output_schema, input_schema,
signing_key, auth, stream_id)`` and returns ``(token, state_bytes)`` —
``state_bytes`` exposed separately for the access-log's
``response_state`` field.

Other cleanups in the dispatcher:

* External-location resolution on the inbound input batch now lives
  inside ``_run_http_exchange_turn``, so resolution failures land
  inside the telemetry shell and produce a proper access-log record
  with ``status="error"``.  Previously they raised ``_RpcHttpError``
  before the telemetry envelope opened, bypassing the access log.
* Drop the defensive
  ``token if isinstance(token, bytes) else token.encode() if token else None``
  ladder — token comes from Arrow custom-metadata (always ``bytes``)
  and the dispatcher rejects the ``None`` case higher up with HTTP 400.
* Tighten the comment on ``info = app._server.methods.get(method_name)``
  to reflect that this path is only reached for known stream methods
  (``_resources.py`` 404s unknowns before dispatch); the ``info=None``
  passed to the cancel telemetry shell is deliberate, not defensive.

A small ``_exchange_error_response`` helper packages the "discard the
oversize body, emit a fresh response with only the EXCEPTION batch"
pattern shared between the wire-cap and external-cap overshoot paths
in the new turn helper.

Verification:

* ruff / mypy / ty: clean.
* HTTP conformance against regular worker: 97 pass / 4 skip
  (strict-fail tests skip via capability discovery).
* HTTP conformance against strict-cap worker: 99 pass / 2 skip
  (externalisation-only tests).
* Full pytest: 2986 passed.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: rustyconover