feat(xpp/http): httptest — three-layer HTTP testing (tower/axum + wiremock aligned) - #87

…emock aligned)

Replaces the 540-line hand-rolled test_server.h with a three-layer
testing model aligned with the Rust ecosystem (todos/httptest.md, done):

  Layer 0  router(req) direct call          — already exists (PR #85);
           in-process, no sockets — handler/router/middleware unit tests
  Layer 1  test::Server (test/server.h)     — THIS: real TCP fixture for
           client tests & end-to-end
  Layer 2  test::EvilServer (test/evil_server.h) — fault injection
           (truncated Content-Length — what a well-formed server can't do)

test::Server (libxpp/xpp/http/test/server.h):
- Three constructors dispatched by first-arg type (first_arg trait):
  builder-configurator (multi-route), single handler (Router fallback),
  and TestResponseSpec (data-driven: echo/redirect/delay/mid-body-stall)
- Construct = start (bind 127.0.0.1:0 + listen sync, port valid
  immediately); RAII dtor = stop + drain; bind failure asserts
  (mirrors Go httptest.NewServer panic)
- url() for ready-to-use client URLs
- Spec compiles into Router routes — no hand-rolled HTTP anywhere

test::EvilServer (libxpp/xpp/http/test/evil_server.h):
- Raw TCP (~100 lines): declares full Content-Length, sends partial
  body, hard-closes — the mid-body-disconnect fault injection that
  test::Server cannot produce

Per-file tests (the 'each file gets a test' convention):
- test/server_test.cpp — 7 tests: handler ctor, spec ctor, redirect,
  echo body, echo method, builder-configure (:param injection), delay
- test/evil_server_test.cpp — 1 test: declared 1MB / sent 64KB
  truncation surfaces as a body-read error

Migration: client_test.cpp + http_convenience_test.cpp now use the new
fixtures (test::Server + test::EvilServer); old http/test_server.h
deleted (−540 lines of hand-rolled HTTP parsing/response building).

The spec's echo_request_method now works alongside echo_request_body
(method captured before the Request is consumed by into_body()).

Verified: ASan full suite 83/83 (69 existing + 14 new tests).

The response streaming path (stream_channel_body) held a raw xHttpCtx*
across suspension points, protected only by ServerLifetime, which covers
server teardown but not connection teardown. On client disconnect the
event loop frees the stream (and the xHttpCtx embedded in it) via
xHttpConnClose — a path that never reaches on_done — so the parked
streaming task wrote the freed ctx, a heap-use-after-free.

Add an on_close callback to xHttpRouteInfo, invoked by xHttpConnClose
before the stream is freed, plus a ConnLifetime (Arc<bool closed>) keyed
by ctx address that the streaming task checks before touching ctx.