perf: Replace exception-driven control flow in DefaultValidator with Optional returns

JFR profiling under load showed ~267 ValidationException throws/sec on
the happy path — oneOf/anyOf branch selection was catching exceptions
to determine which branch matched, paying allocation + stack-walk cost
for every non-matching branch even when the request ultimately succeeded.

Internal validation now returns Optional<ValidationError> and branch
selection inspects the result. ValidationException is constructed at
most once per request, only at the public validate() boundary when
real validation has failed. A static counter on ValidationException
makes the contract observable and testable.

Author: thced

src/main/java/com/retailsvc/http/ValidationException.java

@@ -1,13 +1,22 @@
 package com.retailsvc.http;
 
 import com.retailsvc.http.validate.ValidationError;
+import java.util.concurrent.atomic.AtomicLong;
 
 public final class ValidationException extends RuntimeException {
+  /**
+   * Counts every {@code ValidationException} ever constructed. Used to assert that the validator
+   * does not use exceptions as control flow on the happy path: a successful validation of a body
+   * containing {@code oneOf}/{@code anyOf} branches should leave this counter unchanged.
+   */
+  public static final AtomicLong CONSTRUCTIONS = new AtomicLong();
+
   private final transient ValidationError error;
 
   public ValidationException(ValidationError error) {
     super(error.pointer() + " [" + error.keyword() + "] " + error.message());
     this.error = error;
+    CONSTRUCTIONS.incrementAndGet();
   }
 
   public ValidationError error() {