Why can't the server send unsolicited messages in JSON-RPC?
I've implemented bidirectional JSON-RPC in multiple projects and things work just fine, even going as far as sharing most of the code.
Yep, the web server and client can both act as JSON-RPC servers and clients. I've used this pattern before too with Web Workers, where the main thread acts as both client (sending requests to the worker) and server (fielding requests from the worker).