feat(web): add mw.RequestIDFrom (resolver sees the request); dependency refresh; v1.4.0

mw/doc.go

@@ -12,6 +12,21 @@
 //	    mw.CORS([]string{"https://example.com"}),
 //	)
 //
+// # Request IDs
+//
+// [RequestID] always generates a fresh ID. To continue a correlation ID a client
+// already sent — so a distributed trace survives this boundary — use [RequestIDFrom]
+// and read the ID off the request in your resolver. The framework does not read the
+// header or validate the value: what is acceptable is per-service (a typed audit
+// column rejects what an opaque log accepts), so that policy stays with the caller.
+//
+//	mw.RequestIDFrom(func(r *http.Request) string {
+//	    if id, err := uuid.Parse(r.Header.Get("X-Request-ID")); err == nil {
+//	        return id.String()   // continue the client's id
+//	    }
+//	    return uuid.NewString()  // otherwise mint one
+//	})
+//
 // # Rate limiting
 //
 //	// In-memory (default — no extra dependencies)