feat(acp): serve /acp from the embedded openab run gateway

#1260 mounted the ACP endpoint only on the standalone `openab-gateway`
binary (`serve()`). Fleet deployments run the unified binary's embedded
gateway (`openab run`, main.rs) instead, which never called `serve()` — so
`/acp` was unreachable there.

Mount `/acp` on the embedded gateway too (gated by `OPENAB_ACP_ENABLED`),
and route ACP replies back through the unified adapter's `dispatch_reply`
(`platform == "acp"`). Requires the embedded gateway to be active (at least
one platform / `[gateway]` configured).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: brettchien

docs/adr/acp-server-websocket-phase1.md

@@ -25,9 +25,16 @@ third-party ACP clients (Zed, JetBrains, …) interoperate — no custom method
 
 ## 2. Decision — Phase 1 primitive surface (ACP-conformant)
 
-Transport: `GET /acp`, feature-gated `acp` + runtime `OPENAB_ACP_ENABLED`. Token auth
-on the WS upgrade via timing-safe compare (`subtle::ConstantTimeEq`,
-`OPENAB_ACP_AUTH_KEY`). JSON-RPC 2.0; non-`"2.0"` rejected with `-32600`.
+Transport: `GET /acp`, feature-gated `acp` + runtime `OPENAB_ACP_ENABLED`. Mounted on
+**both** the standalone `openab-gateway` binary (`serve()`) **and** the embedded
+gateway of `openab run` (the unified binary) — so fleet deployments that run
+`openab run` (not the standalone gateway) serve ACP too. Requires the embedded
+gateway to be active (at least one platform/`[gateway]` configured). ACP replies are
+routed back via the unified adapter's `dispatch_reply` (`platform == "acp"`).
+
+Token auth on the WS upgrade via timing-safe compare (`subtle::ConstantTimeEq`,
+`OPENAB_ACP_AUTH_KEY`; unset ⇒ unauthenticated). JSON-RPC 2.0; non-`"2.0"` rejected
+with `-32600`.
 
 ### Client → Agent (requests)
 

src/main.rs

@@ -1113,6 +1113,20 @@ async fn main() -> anyhow::Result<()> {
                 );
             }
 
+            // ACP server endpoint — mount on the embedded gateway so `openab run`
+            // (not just the standalone gateway binary) serves ACP over WebSocket.
+            #[cfg(feature = "acp")]
+            if std::env::var("OPENAB_ACP_ENABLED")
+                .map(|v| v == "true" || v == "1")
+                .unwrap_or(false)
+            {
+                info!("unified: ACP server endpoint enabled at /acp");
+                app = app.route(
+                    "/acp",
+                    axum::routing::get(openab_gateway::adapters::acp_server::ws_upgrade),
+                );
+            }
+
             let app = app.with_state(gw_state.clone());
 
             // Bridge task: receive events from adapters via event_tx, dispatch to core

src/unified_adapter.rs

@@ -89,6 +89,12 @@ impl UnifiedGatewayAdapter {
                     .await;
                 }
             }
+            #[cfg(feature = "acp")]
+            "acp" => {
+                if let Some(ref registry) = self.gw_state.acp_reply_registry {
+                    openab_gateway::adapters::acp_server::handle_reply(reply, registry).await;
+                }
+            }
             other => {
                 tracing::warn!(platform = other, "unified adapter: unknown platform, cannot route reply");
             }