feat: optional middleware chain in run_rsgi before route match #11

Context

• No hook for metrics, CORS, or auth that runs before the router (except per-route JWT).

Design

• App.add_middleware(f) where f(scope, protocol) -> Result<ControlFlow, …> in Rust, or a list of Py<PyAny> pre-handlers. Short-circuit to a response (e.g. 204 for OPTIONS preflight).

Scope

• High complexity; start with a single optional Python callable for an MVP.

Acceptance criteria

• Test that a CORS preflight can return 204 without hitting the route handler.

Research

• CORS: Access-Control-Request-Method / Origin (Fetch).