feat(rpc): add target policy, protocol schemas, and tagged errors

- Add normalizeLoopbackTarget() with loopback-only URL validation
- Add JSON-RPC response decoder with schema validation
- Define 8 tagged errors using Data.TaggedError
- 20 tests covering target policy and protocol decoding
- Re-export all public types from index.ts

web/packages/rpc/src/target-policy.test.ts

@@ -0,0 +1,41 @@
+import { describe, expect, it } from "vitest";
+import { InvalidTargetError, normalizeLoopbackTarget } from "./target-policy.js";
+
+describe("normalizeLoopbackTarget", () => {
+  it.each([
+    ["http://127.0.0.1:8765/rpc", "http://127.0.0.1:8765/rpc"],
+    ["http://localhost:8765/rpc", "http://localhost:8765/rpc"],
+    ["http://[::1]:8765/rpc", "http://[::1]:8765/rpc"],
+  ])("accepts loopback target %s", (input, expected) => {
+    expect(normalizeLoopbackTarget(input)).toBe(expected);
+  });
+
+  it.each([
+    "https://127.0.0.1:8765/rpc",
+    "http://example.com:8765/rpc",
+    "http://user:[email protected]:8765/rpc",
+    "http://127.0.0.1/rpc",
+    "http://127.0.0.1:8765/rpc?x=1",
+    "http://127.0.0.1:8765/rpc#fragment",
+  ])("rejects unsafe target %s", (input) => {
+    expect(() => normalizeLoopbackTarget(input)).toThrow(InvalidTargetError);
+  });
+
+  it("rejects invalid URL", () => {
+    expect(() => normalizeLoopbackTarget("not a url")).toThrow(
+      InvalidTargetError,
+    );
+  });
+
+  it("rejects port 0", () => {
+    expect(() => normalizeLoopbackTarget("http://127.0.0.1:0/rpc")).toThrow(
+      InvalidTargetError,
+    );
+  });
+
+  it("rejects port above 65535", () => {
+    expect(
+      () => normalizeLoopbackTarget("http://127.0.0.1:65536/rpc"),
+    ).toThrow(InvalidTargetError);
+  });
+});