feat(web): initial implementation — server, mw, httputil, health (v1.0.0)

Introduces code.nochebuena.dev/einherjar/web — the HTTP transport layer of the
Einherjar framework. Absorbs httpserver, httpmw, and httputil from micro-lib,
replacing gorilla/mux with chi, adopting SecurityBag-native middleware, and
centralizing error handling through a single httputil.Error function.

server:
- Server interface — embeds lifecycle.Component and chi.Router
- Config struct (EINHERJAR_SERVER_* env vars); DefaultConfig
- New(logger, cfg, opts...) Server; WithMiddleware option
- Binds TCP synchronously in OnStart; logs "server: listening" on success
- Graceful shutdown within ShutdownTimeout on OnStop

mw:
- Recover — catches panics, returns 500, logs at Error
- RequestID — injects UUID v7 (UUID v4 fallback) into context and X-Request-ID header
- RequestLogger — structured access log per request
- CORS / CORSAllowAll — chi-based, applied only when origins non-empty
- IPRateLimit / UserRateLimit — pluggable RateLimiterStore interface
- InMemoryRateLimiterStore — token-bucket backed by golang.org/x/time/rate;
  background goroutine evicts stale entries every 5 minutes
- StatusRecorder — wraps ResponseWriter to capture HTTP status code

httputil:
- Handle[Req, Res] / HandleNoBody[Res] / HandleEmpty[Req] — generic handler adapters
- Error(logger, w, r, err) — derives log level from status (≥500→Error, 4xx→Warn,
  499→Info); writes standardized JSON body; logz enriches *xerrors.Err automatically
- JSON(w, status, v) / NoContent(w) — response helpers
- HandlerFunc adapter type

health:
- NewHandler / NewHandlerWithConfig — runs all Checkable checks concurrently;
  returns JSON {status, components} with per-component latency and error
- Config struct (EINHERJAR_HEALTH_CHECK_TIMEOUT, default 5s)

Root factory:
- web.New(logger, cfg...) Server — composes Recover+RequestID+RequestLogger+CORS
  in outermost-first order; CORS applied only when AllowedOrigins non-empty

- server.Server interface and web/server/identifiable.go: embeds observability.Identifiable;
  ModulePath and ModuleVersion read via runtime/debug.ReadBuildInfo() — prints in launcher banner

.gitea/CODEOWNERS

@@ -0,0 +1 @@
+* @einherjar/CoreDevelopers @einherjar/Agents

.gitea/pull_request_template.md

@@ -0,0 +1,70 @@
+## Summary
+
+<!-- One or two sentences: what does this PR do and why? -->
+
+---
+
+## Type of change
+
+- [ ] Bug fix — non-breaking change that resolves an issue
+- [ ] New feature — non-breaking addition of functionality
+- [ ] Breaking change — alters existing behavior or public API
+- [ ] Documentation update
+- [ ] Refactor — no functional change, no new API surface
+- [ ] Test improvement
+
+---
+
+## Description
+
+<!--
+Provide enough context for a reviewer who was not in the room:
+- What problem does this solve?
+- What approach did you choose, and why?
+- Were there alternatives you considered and rejected?
+- Any known limitations or follow-up work?
+-->
+
+---
+
+## Testing
+
+- [ ] I added or updated tests that cover my changes
+- [ ] All tests pass locally — `go test ./...`
+- [ ] No formatting issues — `gofmt -l .` produces no output
+- [ ] No vet warnings — `go vet ./...` is clean
+
+---
+
+## Checklist
+
+- [ ] At most one exported type per non-test `.go` file (CT-6)
+- [ ] No new external dependencies added without prior discussion in an issue
+- [ ] Public API changes are reflected in `CHANGELOG.md`
+- [ ] Breaking changes include a migration note in the PR description above
+
+---
+
+## Contributor License Agreement
+
+> **This PR will not be merged until the CLA comment is present.**
+
+Before a Maintainer reviews your code, you must post the following text **as a comment on this PR** — not here in the description. PR description checkboxes can be silently toggled by anyone; a comment is a timestamped, author-attributed record that cannot be quietly removed.
+
+**Copy and post this exact text as a PR comment:**
+
+---
+
+> I have read the Einherjar Contributor License Agreement (CLA.md) and I agree to all its terms.
+> I confirm this Contribution is my original work. I grant the Maintainers the rights described
+> therein, including the right to relicense, and I retain ownership of my copyright.
+> This agreement covers all future Contributions I submit to any Einherjar repository under
+> this account.
+
+---
+
+First time contributing? Read [CLA.md](../CLA.md) for the full agreement before posting the comment.
+
+If you are contributing on behalf of a company, an authorized representative of that company must post the comment.
+
+<!-- Thank you for contributing to Einherjar. For those who come after. -->