feat(middleware): broaden HTTP header mutation authority

[pimlock]

Summary

Remove the request-only header write namespace and centralize middleware header mutation checks. This is the base of the #2691 stack and keeps the authority change separate from response processing.

Related Issue

Part of #2691

Changes

• Allow middleware to write permitted end-to-end request headers without an x-openshell-middleware- prefix.
• Route writes and removals through one atomic validator and applicator.
• Define request and response authority profiles with protected credential, routing, framing, connection, and security fields.
• Add focused tests for shared limits, atomicity, direction-specific protection, and unrestricted end-to-end fields.

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated, not applicable to this isolated validator change

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated, deferred to docs(middleware): document response pre-return workflow #3075

Stack

1. feat(middleware): broaden HTTP header mutation authority #3072 — shared header mutation authority
2. feat(middleware): define HTTP response pre-return interface #3073 — response protobuf and transport interface
3. feat(network): inspect HTTP responses before return #3074 — response runtime, relay integration, and existing example
4. docs(middleware): document response pre-return workflow #3075 — documentation and middleware guide reorganization

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[pimlock]

/ok to test 4b3b641