…ure overhaul

Security:
- Slow-loris defense with per-connection byte/time budgets
- HTTP request smuggling detection (reject TE + Content-Length)
- Keyed SipHash via RandomState for hash-flooding resistance
- Session hardening: HMAC-SHA256 signed cookies, LRU eviction,
  max_data_size guard, constant-time signature comparison
- Rate limiter bounded to 100K entries with two-pass LRU eviction
- Security headers middleware (helmet) — 11 pre-computed headers
- Request ID middleware for end-to-end correlation

Performance:
- Zero-heap-alloc route matching with ArrayVec (stack-allocated params)
- Header name interning — top 20 headers by length-first branching
- Clone elimination in cache key interpolation (direct slice pass)
- Dual-lane FNV-1a hash for fast static-route lookup
- AST-based handler analysis (acorn) with regex fallback for
  zero-copy access plans — skip materializing unused request fields
- Compressed static route responses (Brotli + Gzip pre-built at startup)

Architecture:
- Extracted parser.rs, response.rs, http_utils.rs from monolithic lib.rs
- Structured log macros (hn_info!, hn_warn!, hn_error!, hn_debug!)
- HTTP response builder consolidated in response.rs

DX & API:
- Full TypeScript declarations for all public APIs and sub-modules
- app.head() method registration
- app.health() convenience API (Rust static fast-path, zero JS dispatch)
- res.redirect() on response prototype
- Session, helmet, request-id, compress type exports in package.json
- session.d.ts with SessionStore, MemoryStore, RedisStore types