feat(middleware): conditional execution, timeout, circuit breaker, RBAC & performance docs

[BigBen-7]

Summary

• Conditional Middleware Execution #381 — Conditional Middleware Execution: unless() and onlyFor() higher-order wrappers supporting exact string, regex, and glob (micromatch) patterns with zero overhead on non-matching routes
• Middleware Timeout & Circuit Breaker #379 — Middleware Timeout & Circuit Breaker: TimeoutMiddleware (503 after configurable ms threshold) + CircuitBreakerMiddleware/CircuitBreakerService implementing the full CLOSED → OPEN → HALF_OPEN state machine with configurable failure threshold, reset timeout, and health-check state accessor
• Role-Based Access Control Middleware #371 — Role-Based Access Control Middleware: rbacMiddleware() factory with ADMIN > MODERATOR > USER hierarchy, OR logic for multi-role routes, 403 with clear messages, and audit logging for unauthorized attempts
• Response Time Optimization Guide #353 — Response Time Optimization Guide: docs/PERFORMANCE.md with 6 techniques (lazy init, JWT payload caching, short-circuit, async crypto, GC pressure reduction, circuit breaker under outages) and 3 anti-patterns, each with before/after snippets and benchmark deltas

New files

File	Issue
middleware/src/middleware/utils/conditional.middleware.ts	#381
middleware/src/middleware/advanced/timeout.middleware.ts	#379
middleware/src/middleware/advanced/circuit-breaker.middleware.ts	#379
middleware/src/auth/rbac.middleware.ts	#371
middleware/docs/PERFORMANCE.md	#353

All new exports are re-exported from src/index.ts and src/auth/index.ts.

Test plan

• 37 unit tests added covering all state transitions, pattern types, role hierarchy, and edge cases
• npm test passes — 4 suites, 37 tests, 0 failures
• Reviewer: verify unless(['/health']) skips middleware in an integration context
• Reviewer: verify circuit breaker state is surfaced in the health endpoint

Closes #381
Closes #379
Closes #371
Closes #353

[drips-wave]

@BigBen-7 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits