refactor: clear middleware quality gate

[jonbaldie]

Closes #33.

What changed

• Renamed the shared health-route pattern to satisfy the pinned messcript constant-naming rule.
• Added a real-request canary proving rate limiting executes before authentication: the first unauthenticated request returns 401 and consumes the slot; the second returns 429.
• Added no suppression, exclusion, policy change, mock, or production behavior change.

TDD evidence

• Structural red: quality:unit -- middleware reported ConstantNamingConventions for healthPattern.
• Structural green: the same command exits 0 after the minimal rename.
• Ordering red: under a temporary auth-first composition, the new canary failed with actual 401 vs expected 429.
• Ordering green: under the real rate-limit-first composition, the canary passes with 401 then 429.

Validation

• Full Deno suite: 178 passed, including real socket startup/shutdown E2E tests.
• Handler public seam: 94 passed.
• deno lint src/middleware.ts passed.
• Two-axis standards/spec review passed with no findings.
• GitHub Actions will run Test → Mutasaurus → Stryker on this PR.