Phase A: route the interaction dispatcher through a gateway

Phase A of #3607035 (the interaction-gateway plan in the issue): a pure refactor, no behavior change.

Introduces InteractionGatewayInterface (the dispatcher URLs plus a resume() of the parked step) and CapabilityGateway, the bearer-token strategy that wraps the dispatcher's current behavior: its URLs delegate to the token-bearing URL service, and resume() goes straight to the engine (resumeWithResult()). InteractionController now resolves and resumes through the gateway instead of calling the URL service and the engine directly.

This is the seam later phases build on: the same interaction plugins will resume under a session or assignment gateway with no change to the plugins. ReviewHandlerForm (the assignment path) is intentionally left for Phase B, when the assignment gateway exists.

Tests: new CapabilityGatewayTest (resume advances once then no-ops; every URL equals the underlying URL service). Full orchestra_interaction kernel suite green (39 tests), confirming no behavior change. phpcs, phpstan (level 1) and cspell clean.