Problem

The gateway logic in taktora-medkit-gateway is pure (&MergedView, params) -> SovdResponse functions with no transport. There is no running server, so "drop-in client compatibility" is untestable end-to-end. We need the thinnest vertical slice that takes HTTP in and emits contract-correct SOVD JSON out — backed by the existing mock provider so it runs with no taktora wiring, no hardware, and no iceoryx2.

Proposal

Build taktora-medkit-gateway-axum: a tokio/axum transport that mounts the pure gateway handlers over the in-process MockProvider + MergePipeline, serving the read-diagnostic core families on the /api/v1 prefix:

• GET /api/v1/, /api/v1/version-info, /api/v1/health
• Entity tree (read): areas, components, apps, functions, each with {id} and the relationship sub-resources the contract defines (/contains, /components, /hosts, /depends-on, /is-located-on, /belongs-to).
• Faults: GET /faults, GET /components/{id}/faults, GET/DELETE /components/{id}/faults/{fault_code}, with the ?status= filter (pending|confirmed|cleared|healed|all).
• data (read): GET /components/{id}/data[/{topic_path}] sourced from what the (mock for now) provider exposes.

Deferred families return a contract-shaped 501 Not Implemented (ros2_medkit itself uses 501 for disabled features): operations, configurations-write, bulk-data, locks, scripts, updates/OTA, and the x-medkit-* vendor endpoints. Wire the routes so a path-hardcoding client gets a clean documented 501, not a 404/parse error.

Fold in the baseline transport hardening here rather than a separate slice: CORS, a token-bucket rate limit, and optional TLS — all configurable, all off the control path (this process is free to heap-allocate and run tokio).

Responses are diffed against contract/golden/ so the served bytes match the captured contract.

Acceptance

• cargo run starts an axum server on the documented default bind that serves the read-core families over /api/v1 backed by the mock provider, with no taktora deps in the core path.
• Every read-core endpoint's response body matches the corresponding contract/golden/*.json shape (integration test hits the live server and diffs).
• Deferred families return 501 with a contract-shaped body; a smoke test asserts 501 (not 404) on at least one route per deferred family.
• CORS, rate-limit, and optional TLS are present and configurable; defaults documented.
• Linking REQ_0900 endpoint requirements and TEST_0900 IDs; cargo test + Linux clippy green.

Why

This is the walking skeleton: once HTTP-in/SOVD-JSON-out works against the mock and passes contract diffing, every later slice (manifest, bindings, triggers, auth) is an incremental, independently-demoable addition to a server that already proves the wire contract.

Blocked by

• medkit-model: align wire types + envelope to the captured ros2_medkit contract (snapshot-tested) #80 (model aligned to the captured contract)