Replace deprecated grpc.DialContext / WithBlock / WithInsecure in the gateway

[SyniRon]

servers/gateway/gateway.go uses grpc.DialContext + grpc.WithBlock()

• grpc.WithInsecure(). All three are deprecated in current grpc-go.

Switch to grpc.NewClient with insecure.NewCredentials(). NewClient
is non-blocking by design, so drop WithBlock entirely.

Pair with a go mod tidy and any related dep refresh. Low-risk hygiene.

The plaintext-dial decision itself is unchanged — see ADR 0002. Only the
API surface moves.

Moot if the "Drop gRPC, go pure JSON" investigation lands first; pick
one.

[SyniRon]

This was generated by AI during triage.

Triage Notes

Scope is confirmed and well-specified:

• servers/gateway/gateway.go dial site uses all three deprecated APIs (grpc.DialContext + grpc.WithBlock() + grpc.WithInsecure()).
• cmd/example.go separately uses the deprecated grpc.Dial + grpc.WithBlock() pair. Recommend bundling into the same PR — same dep, same pattern, would otherwise drift.
• Generated proto/*.pb.gw.go already use grpc.NewClient, so the migration is just bringing in-tree wiring in line with what the generator already emits. ADR 0002's plaintext-dial decision is unaffected — only the API surface moves.

Why this is blocked, not ready-for-agent:

The issue body explicitly says "Moot if the 'Drop gRPC, go pure JSON' investigation lands first; pick one." That investigation is #95, which in turn depends on the gRPC-vs-HTTP traffic-split data from #92. Dispatching this work before the keep-or-drop call is wasted effort if gRPC gets removed.

Unblocker: when #92 produces traffic data and the maintainer commits to keeping gRPC (in #95), flip this to ready-for-agent — the scope above is complete and an agent brief is essentially writable from this comment.

Related: #92 (analytics, blocks the decision), #95 (drop-gRPC investigation, the alternative path).