Fix generated middleware composition across the finalized route graph

[cssbruno]

Problem

Generated RegisterMiddleware middleware was applied only to the "/" fallback handler inside the generated mux. More-specific generated routes—such as dynamic sitemap and realtime endpoints—and routes mounted later by lifecycle services could bypass the documented app-wide middleware chain.

Changes

• Build the raw generated route mux without route-local middleware wrapping.
• Snapshot registered middleware around the complete route graph returned by Handler().
• Keep Application.Mux raw for lifecycle route registration while serving it through a finalized wrapped Application.Handler.
• Make ServeMux() expose the generated route graph behind the same finalized middleware wrapper.
• Apply the same composition model to embedded and backend-only generated apps.
• Regenerate the generated-Go golden fixture.
• Document middleware ownership for App(), Handler(), ServeMux(), and caller-added routes.

Regression coverage

• Verifies dynamic sitemap registration is inside the finalized wrapped route graph.
• Rejects the old pattern that wrapped only the generated root fallback.
• Proves middleware created before a lifecycle route is mounted still observes that mounted route exactly once.

Validation

• go test ./internal/appgen -update
• go test ./internal/appgen ./runtime/app
• Full repository CI

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 10609cb75d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Update backend-only middleware assertions

With this change returning the backend-only handler unwrapped at the route level, the backend generation tests still look for the old route-local gowdkruntime.ApplyMiddlewares(...) call. I verified go test ./internal/appgen -run TestGenerateBackendAppRegistersBackendRoutes -count=1 and go test ./internal/appgen -run TestGenerateBackendAppWiresSecurityHeaders -count=1 both fail on those stale expected strings, so the appgen CI gate remains blocked until those expectations are updated to the new finalized-wrapper output.

Useful? React with 👍 / 👎.