feat: add timeout-bounded regex routing

[MikiEEE]

Summary

• add timeout-bounded regular-expression routes with GET/POST/PUT/PATCH/DELETE decorators
• split raw request targets into routing path and query string while preserving encoded octets
• expose immutable named captures and route identity on Request
• preserve dictionary-based static precedence and deterministic 404/405 behavior
• report sanitized route timeout events through a bounded SmallOS-owned observer task
• add optional dependency packaging, documentation, installed-wheel smoke coverage, and a static-dispatch performance gate

Resource and security boundary

• finite path, pattern, route, named-capture, per-match, and total-match limits
• regex matching uses the optional regex engine with operation deadlines
• oversized routing paths return 414 before invoking the engine
• observer events contain only opaque route ID/category and do not retain request data
• no raw worker thread, asyncio loop, or platform networking dependency is introduced

Review remediation

Critic and adversarial review findings resolved:

• removed an unsafe literal-prefix optimization that rejected valid alternations
• preserved positional ServerConfig compatibility
• structurally guards all regex matching to origin-form slash paths
• fixed named-group/comment validation
• added sanitized 414 and timeout observability paths
• eliminated observer traceback/request retention
• added a zero-allocation static fast path and an enforced 80% legacy-throughput floor
• clears stale/spoofed route context before static handlers
• moved observer execution from a raw thread to a bounded SmallOS task with deterministic startup/shutdown ownership
• rejected statistically meaningless release benchmark samples

Final critic gate: PASS
Final adversarial gate: PASS

Validation

• full regex + adapter suite: 56/56 passed unrestricted
• missing-extra/static suite: 40 passed, 16 expected regex skips
• all loopback and adapter concurrency tests passed unrestricted
• release benchmark passed at approximately 0.85–0.87 of legacy static dispatch (floor: 0.80)
• installed [regex-routes] wheel smoke passed
• compilation and git diff --check passed
• no adapter files or exports are removed relative to main

Residual validation

The available host is Python 3.9.6 while project metadata requires Python 3.10+. The installed-wheel smoke used the host-only Requires-Python override; CI/release validation should repeat it natively on Python 3.10+ with a modern build frontend.