feat(httpmw): initial stable release v0.9.0

Standalone net/http middleware for panic recovery, CORS, request ID injection, and request logging.

What's included:
- Recover(): panic -> 500, captures debug.Stack, no logger required
- CORS(origins): OPTIONS 204 preflight, origin allowlist, package-wide method/header constants
- RequestID(generator): injects ID via logz.WithRequestID, sets X-Request-ID response header
- RequestLogger(logger): logs method/path/status/latency/request_id; Error for 5xx, Info otherwise
- Logger interface: Info, Error, With — duck-typed; satisfied by logz.Logger
- StatusRecorder: exported http.ResponseWriter wrapper that captures written status code
- Direct logz import for context helpers (documented exception to ADR-001)

Tested-via: todo-api POC integration
Reviewed-against: docs/adr/

compliance_test.go

@@ -0,0 +1,19 @@
+package httpmw_test
+
+import (
+	"net/http"
+
+	"code.nochebuena.dev/go/httpmw"
+)
+
+type complianceLogger struct{}
+
+func (c *complianceLogger) Info(msg string, args ...any)              {}
+func (c *complianceLogger) Error(msg string, err error, args ...any) {}
+func (c *complianceLogger) With(args ...any) httpmw.Logger            { return c }
+
+// Compile-time check: complianceLogger satisfies httpmw.Logger.
+var _ httpmw.Logger = (*complianceLogger)(nil)
+
+// Compile-time check: StatusRecorder satisfies http.ResponseWriter.
+var _ http.ResponseWriter = (*httpmw.StatusRecorder)(nil)