Add router features: regex escaping, constraints, any(), and group()

[jjn1056]

Summary

• Regex escaping: Literal segments in route paths are now properly escaped with quotemeta, preventing regex metacharacters (., +, (, etc.) from being interpreted as patterns
• Inline constraints: {name:pattern} syntax in paths (e.g., /users/{id:\d+}) for compile-time parameter validation
• Chained constraints: ->constraints(name => qr/.../) method for adding constraints after route definition
• any() method: Register routes matching any HTTP method, or a specific list of methods via method => [...]
• group() method: Flatten routes under a shared prefix with shared middleware — three forms:
  • Callback: $router->group('/api' => [$mw] => sub { ... })
  • Router-object: $router->group('/api' => $other_router) (snapshot semantics)
  • String: $router->group('/api' => 'MyApp::Routes::Users') (auto-require)
• Nested groups: Prefix and middleware accumulate naturally across nested group() calls
• Named routes in groups: Full prefixed path, conflict detection (croak on duplicate), as() namespacing
• Constraint storage refactor: Split inline vs chained constraints for clean route copying
• Security fixes: CSRF/Session secure random, Debug XSS escape, Static double-decode, chunked DoS limit, RequestId secure random, CORS wildcard warning, rate limiter cleanup
• SSE over HTTP/2: Full SSE support in HTTP/2 code path — detection via Accept header, streaming DATA frames (no chunked encoding), keepalive comments, disconnect handling, connection cleanup, idle timeout documentation with trade-offs

Test plan

• prove -l t/app-router.t — existing router tests + constraint storage test
• prove -l t/router-named-routes.t — named route tests unchanged
• prove -l t/app-router-group.t — 22 subtests covering all group() forms, middleware, nesting, named routes, as(), WS/SSE, error handling, integration
• prove -l t/router-middleware.t t/endpoint-router.t t/sse-router-support.t — no regressions
• prove -l t/http2/13-sse-detection.t — SSE detection + scope type over H2
• prove -l t/http2/14-sse-events.t — full send/receive SSE session over H2
• prove -l t/http2/15-sse-keepalive.t — keepalive comments over H2
• prove -l t/http2/16-sse-cleanup.t — disconnect and cleanup over H2
• prove -l t/sse/12-format-helpers.t — SSE formatting helper unit tests
• prove -l t/ — full suite passes (minus known pre-existing failures in t/42-file-response.t, t/app-file.t)

🤖 Generated with Claude Code