A2A JSON-RPC endpoint

A2A Protocol v1.0 JSON-RPC 2.0 transport endpoint. The request body is a JSON-RPC 2.0 envelope `{ jsonrpc: "2.0", id?, method, params }` dispatched on `method`. Method names are the 1.0 PascalCase forms; the legacy 0.3 slash-strings are still accepted as tolerant aliases: - `SendMessage` (alias `message/send`) — params: `{ message, configuration?, metadata? }`; returns an envelope whose `result` is `{ task }`. - `SendStreamingMessage` (alias `message/stream`) — params: same; returns a `text/event-stream` of A2A 1.0 StreamResponse events. - `GetTask` (alias `tasks/get`) — params: `{ id | taskId, historyLength? }`; returns a Task envelope. - `ListTasks` — params: `{ pageSize?, pageToken?, status?, includeArtifacts? }`; returns `{ tasks, nextPageToken, pageSize, totalSize }` (cursor-paginated). - `CancelTask` (alias `tasks/cancel`) — params: `{ id | taskId }`; returns a Task envelope. - `SubscribeToTask` (alias `tasks/resubscribe`) — params: `{ id }`; returns a `text/event-stream` of A2A 1.0 StreamResponse events. Each streaming `data:` line is a JSON-RPC response carrying a `StreamResponse` oneof (`statusUpdate` / `artifactUpdate`); errors stream as a JSON-RPC error envelope (`google.rpc.Status` form). The body is validated by the handler (not by request-schema middleware) so JSON-RPC error envelopes (`-32700`, METHOD_NOT_FOUND, INVALID_PARAMS) are preserved. Authentication is an A2A surface key (Authorization: Bearer a2a_xxx or X-API-Key header) or a Clerk JWT (dashboard testing).