fix(core): support JSON-RPC batch requests

[koriyoshi2041]

Problem

The HTTP middleware rejects every top-level JSON-RPC batch before the handler can dispatch it. This breaks clients such as @solana/web3.js when they use batched RPC calls.

Fix

Move method-level logging and cheatcode lockout checks to the middleware's per-call hook. The JSON-RPC handler can now dispatch batch entries independently while each entry still receives the same policy checks as a single call. Batch notifications are executed without producing response entries, as required by JSON-RPC 2.0.

Test

• cargo test -p surfpool-core middleware_tests -- --nocapture — 2 passed
• cargo clippy -p surfpool-core --lib --no-deps — passed with existing repository warnings
• git diff --check — passed

The regression tests cover multiple IDs in one batch and a mixed notification/method-call batch.

Risk

The change is limited to HTTP middleware dispatch. Single method calls keep the same metadata and cheatcode lockout behavior. Request-body size remains bounded by the server's existing 15 MiB limit. WebSocket middleware is unchanged.

Closes #717.

[greptile-apps]

Greptile Summary

The PR moves HTTP JSON-RPC policy enforcement and error logging from request-level middleware to per-call middleware, allowing batch requests to be dispatched correctly.

• Preserves independent responses for each method call in a batch.
• Executes notifications without emitting response entries.
• Enforces disabled-cheatcode policy independently for every batch entry.
• Adds regression coverage for successful batches, mixed notifications, isolated errors, and cheatcode enforcement.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
crates/core/src/rpc/mod.rs	Moves request policy into the per-call middleware hook and adds focused batch-dispatch regression tests without an eligible follow-up defect.

Sequence Diagram

sequenceDiagram
    participant Client
    participant RequestMiddleware
    participant CallMiddleware
    participant Handler
    Client->>RequestMiddleware: JSON-RPC request or batch
    RequestMiddleware->>RequestMiddleware: Attach RunloopContext
    loop Each call or notification
        RequestMiddleware->>CallMiddleware: Dispatch entry
        CallMiddleware->>CallMiddleware: Log method and enforce cheatcode policy
        alt Disabled cheatcode method call
            CallMiddleware-->>Client: Error output for this entry
        else Disabled cheatcode notification
            CallMiddleware-->>Client: No response entry
        else Allowed entry
            CallMiddleware->>Handler: Invoke method
            Handler-->>CallMiddleware: Optional output
            CallMiddleware-->>Client: Preserve output when present
        end
    end

Loading

_{Reviews (3): Last reviewed commit: "test rpc batch cheatcode policy" | Re-trigger Greptile}

[MicaiahReid]

Thanks for the PR, @koriyoshi2041!! I'm reviewing now! In the meantime, Foundation repos require verified commit signatures to merge. Can you set up commit signature verification and repush this change so I can merge?

[MicaiahReid]

This is awesome, thanks again @koriyoshi2041! Just waiting on the verified commits and CI to be green and we'll merge!

[MicaiahReid]

Hey @koriyoshi2041 just following up on if you can set up verified commits and re-push