fix(gateway): mount OAuth routers before API fallback

The persistent gateway registered native/device OAuth and MCP routers from unawaited dynamic imports. Express registered the terminal /api/v1 fallback first, so public native and device discovery returned 401.

This change mounts the existing routers deterministically before the fallback and listener, makes required-router startup failures fatal, preserves existing auth/provider behavior, and adds real bootstrap regression coverage. It also records the already-completed production deployment outside sealed W4 evidence.

Validation:

• focused bootstrap: 14 passed
• narrow OAuth/CORS/MCP: 192 passed
• broader gateway/auth: 1,433 passed
• full tracked suite: 4,641 passed, 0 failed, 0 skipped
• production-baseline relevant suite: 193 passed, 0 failed
• no dependency or lockfile change

Production currently returns 200 for health and root/native/device discovery, and 401 for unauthenticated /mcp. This source integration performs no deployment or configuration change and makes no W4 qualification claim.