feat(web): add mw.RequestIDFrom (resolver sees the request); dependency refresh; v1.4.0

CHANGELOG.md

@@ -6,6 +6,31 @@ This module adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html
 
 ---
 
+## [1.4.0] — 2026-08-09
+
+Minor — resolvable request IDs, plus a dependency refresh.
+
+### Added
+
+- **`mw.RequestIDFrom(resolve func(*http.Request) string)`** — the resolver sees the request,
+  so a service can continue a correlation ID a client already sent (a distributed trace survives
+  this boundary). The framework provides plumbing only: it does not read a header, choose a header
+  name, or validate the value — that policy is the application's, because a value the framework
+  accepts on a service's behalf may be one that service cannot store. Generation becomes the
+  fallback branch of resolution rather than a separate mode.
+
+### Changed
+
+- `mw.RequestID(generator func() string)` is unchanged in signature and behaviour (always
+  generates, ignores inbound); it is now expressed as `RequestIDFrom` with a request-ignoring resolver.
+- Refreshed dependencies (`go-chi/chi/v5` v5.3.1, `golang.org/x/time` v0.15.0).
+- Bumped `contracts`, `core` to v1.4.0.
+
+### Notes
+
+- An empty resolver result attaches no ID (header omitted, context carries none) rather than a
+  silently-empty value; a resolver that can return "" is a caller error.
+
 ## [1.3.0] — 2026-08-08
 
 Minor release carrying a **breaking API change** to CORS configuration. The framework is