Harden path canonicalization, middleware consistency, and hot paths

[jkyberneees]

Summary

Adversarial re-review of the v1.3.0 hardening pass. That release fixed the 43 named findings, but several remediations were incomplete or inconsistent across modules. This PR closes those gaps, then a second adversarial pass (Bugbot + security review) challenged the first revision.

Security

• Dot-segment resolution — %2e%2e / .. are now resolved after URI decoding. Routing and excludePaths share one canonical path, so /admin/../health cannot skip JWT while routing elsewhere.
• Write-once canonical path — the router stores the path on Symbol.for('0http.canonicalPath'). Security middleware never trusts mutable req.path.
• Logger / Prometheus excludePaths — exact or boundary match (same as JWT and rate-limit). /health no longer skips /healthcheck.
• CORS — preflight sets Vary: Origin for static string origins; Origin: null is rejected for all non-wildcard configs; methods compared case-insensitively; origin validators receive (origin, req) as documented.
• Logger — header-supplied request IDs are sanitized; Set-Cookie / Authorization / Cookie / X-Api-Key are redacted on both request serializers and default response logs.
• JWT optional mode — req.ctx.authError is a generic message, not the raw jose error.
• MemoryStore — maxKeys (default 10,000) and amortized cleanup. When full, new keys fail closed (429) instead of FIFO-evicting live counters (the first revision's eviction was rejected on review).

Performance

• Skip decode / slash-collapse / dot-resolution when the path does not need them.
• Reuse a frozen empty query object; single-pass param copy.
• Middleware uses the canonical path instead of new URL() on every request.
• JSON nesting scan short-circuits; body reader uses tracked byte length.
• Custom jsonTypes parsers are cached.

Ergonomics

• Types now include req.path, req.body, req.files, logger options, errorHandler(err, req), extended, and maxKeys.
• ParsedFile.data is Uint8Array (matches the implementation).
• CI runs bun run lint instead of format. Bench script points at bench.ts.

Adversarial review

• Bugbot: no bugs on the first revision.
• Security review: accepted the nine R2 remediations; rejected FIFO maxKeys eviction and trusted req.path. Both are fixed in the follow-up commit. Leftover tokenQuery remains a documented, warned opt-in (removing it would be breaking).

Test plan

• bun test — 525 pass / 0 fail
• bun run lint — prettier check clean
• Path helpers, %2e%2e routing, excludePaths consistency
• Forged req.path does not skip JWT
• MemoryStore fail-closed (existing keys still increment)
• CORS Vary / case-insensitive methods / null origin
• Logger request-ID sanitization and header redaction