The single admission path shared by every gateway protocol adapter.

admit/2 runs, in order and before any backend connection:

1. canonical route and path checks (/, /1.0, /1.0/*; no dot segments, NUL or backslash, raw or percent-encoded; an encoded / inside a segment stays, as image aliases need it);
2. native selection parsing from the raw query, rejecting duplicate or malformed project, target and all-projects values;
3. bounded admission;
4. host readiness;
5. host authorization.

Each host callback runs in its own monitored process under the gateway's callback_timeout and is killed at the deadline, so a slow callback can never authorize later. Protocols not implemented by this gateway revision fail after authorization with an explicit 501.