feat: add bounded cleartext HTTP/2 support

[MikiEEE]

Summary

• add optional hyper-h2 4.x cleartext prior-knowledge HTTP/2 serving
• select HTTP/2 explicitly with protocol="http2"; HTTP/1.1 remains the lazy default
• reuse SmallServer Request, Response, routing, handler, and SmallOS lifecycle boundaries
• multiplex completed streams into separate SmallOS handler tasks with one connection protocol owner/writer
• implement bounded frame/header/body/stream/output/control accounting and flow-controlled DATA
• isolate malformed/reset/client-write failures to their stream or connection without stopping the listener
• add finite preface/inbound-idle deadlines, bounded graceful GOAWAY, and forced shutdown fallback
• add a runnable prior-knowledge example plus comprehensive README and multipage public guide
• preserve optional regex routing and deliver the same bounded, sanitized timeout observer events on HTTP/1.1 and HTTP/2

Review remediation

Independent review found and closed:

• completed request bodies escaping aggregate accounting and duplicate retention
• client writer failures orphaning connections or incorrectly stopping the listener
• malformed method/path/content-length killing unrelated streams
• missing handshake/idle deadlines and blocked-writer shutdown
• partial hyper-h2 installations leaking accepted connections
• unbounded PING/SETTINGS ACK output and reader starvation
• late compressed-header enforcement and close-failure ownership gaps
• same-batch END_STREAM/RST spawning a cancelled handler
• response HEADERS/RST/control/DATA/GOAWAY wire-output budget bypasses
• non-finite timeout configuration and optional-test documentation ambiguity
• protocol-dependent regex timeout observability and missing real loopback ownership coverage

Final gates:

• critic reviewer: PASS
• adversarial reviewer: PASS
• documentation critic: PASS

Validation

Against canonical SmallOS b3b0e17fc518d80f08d9e9b440bfe929f69c6d0b and hyper-h2 4.3:

• full integrated HTTP/2 + regex suite: 149/149 passed unrestricted
• focused HTTP/2 suite: 27/27 passed
• no-extra suite: passed with expected HTTP/2 skips and lazy imports
• declared-minimum hyper-h2 4.0 targeted suite: 19/19 passed
• documentation links/pages/Python fences: passed
• real curl --http2-prior-knowledge smoke: HTTP/2 200
• compile, diff, dependency, and forbidden-import checks: passed

The local host is Python 3.9.6 while metadata requires Python 3.10+, so native Python 3.10+ packaging/static validation remains a CI/release gate.

Dependencies and deferred scope

This PR targets develop and logically depends on PRs #4–#6 for regex routing, kernel transport, and lifecycle. Until those merge, GitHub's diff includes those foundations.

Server TLS/ALPN is explicitly deferred because SmallOS does not yet expose a server-side TLS kernel capability. h2c Upgrade, protocol autodetection, server push, and RFC 8441 are not included.