feat(api): add Fiber operational HTTP adapter

[ryan-wong-coder]

Linked Issue

Fixes #7

Summary

• pin Fiber v3.4.0 and add a framework-neutral readiness provider contract under the documented pkg/api boundary
• add bounded /livez and provider-authoritative /readyz operational probes without wiring a node command or active listener
• enforce body, header-buffer, connection, read/write/idle/request timeout, request-ID, panic, and stable JSON error boundaries
• integrate the zerolog foundation with allowlisted HTTP access logs that never record raw URLs, query strings, bodies, credentials, cookies, headers, panic values, or provider errors
• expose caller-owned Serve(net.Listener) and deadline-required Shutdown(context.Context) lifecycle methods
• document that the adapter exists while the validator runtime, TLS/mTLS, business API, and listener composition remain unimplemented

Required Format

• Branch name: feat/fiber-operational-http
• PR title and commit use Conventional Commits.

Scope And Project Status

• This PR solves one issue or one clearly scoped maintenance task.
• This PR excludes unrelated formatting, experiments, generated files, local data, credentials, logs, captures, and build artifacts.
• User-facing material distinguishes implemented behavior, target design, and roadmap work.
• Any performance claim identifies its source, hardware, configuration, measurement method, and whether it is a FinalWeave result.

No throughput or latency claim is introduced.

Protocol, Safety, And Compatibility

• This PR does not change quorum, Byzantine fault, proposer-slot, stable-prefix, or epoch-transition rules.
• BatchAC still proves recoverable data availability only; it is not treated as transaction validity, ordering, or execution finality.
• Canonical ordering and speculative parallel execution remain deterministic and equivalent to canonical serial Apply.
• External finality remains bound to an authenticated Header, exact FinalityCertificate, locally trusted validator/config chain, and query-specific proofs.
• This PR does not change canonical encoding, domain separation, signatures, IDs, state commitments, or wire schemas.
• WAL, atomic publication, snapshots, pruning, synchronization, replay, and recovery preserve their durable safety boundaries.
• This PR does not change networking, admission, cross-ledger proof validation, or resource-accounting boundaries.
• No production path introduces unbounded scan, sort, load, verification, retry, amplification, or recomputation behavior.

The PR adds an operational HTTP adapter, so the networking/API checkbox is intentionally unchecked. It adds no business route or FinalWeave protocol schema. Construction starts no listener or goroutine. A future recovered composition root must provide the pre-bound listener and TLS wrapper; current CLI behavior remains fail-closed and cannot call Serve. /livez means only that the HTTP event loop responds. /readyz never synthesizes readiness and returns only the injected authority's bounded status.

Request work is bounded by positive hard-capped bytes, header buffer, connection count, and timeouts. The request context deadline is cooperative for application code; Fiber read/write deadlines bound transport I/O. Panic values and arbitrary readiness details are never reflected or logged.

Validation

• git diff --check
• python3 scripts/check_docs.py
• go mod verify and a clean go mod tidy diff
• go vet ./...
• go test -count=1 -mod=readonly ./...
• go test -race -count=1 -mod=readonly ./...
• python3 scripts/check_go_architecture.py
• Relevant unit, race, property, fuzz, vector, model, Byzantine, partition, crash-recovery, snapshot, chaos, and performance checks
• Negative tests cover malformed, conflicting, stale, replayed, oversized, and partially durable inputs where applicable

Additional validation:

• go test -count=20 ./pkg/api/httpserver
• go test -race -count=5 ./pkg/api/httpserver
• Linux amd64 and arm64 node builds with -trimpath
• real loopback tests for serve/shutdown, oversized headers, stable 431 errors, body-limit 413 errors, and no secret disclosure
• in-memory tests for exact body boundary, strict routes, provider-controlled readiness, invalid/typed-nil dependencies, all configuration bounds, request-ID replacement, deadline propagation, panic recovery, allowed log fields, concurrent readiness, and no Server header

Protocol vector, model, Byzantine, partition, recovery, snapshot, and chaos tests are not applicable because no protocol/application runtime, storage, consensus, P2P, or durable state path is added.

Risk And Rollback

Fiber adds a larger transitive dependency graph, including generic codecs that are not imported as FinalWeave canonical encoding. The adapter intentionally performs synchronous access logging, which can apply logger-writer backpressure. Request deadlines require downstream providers to honor context.Context; the transport read/write deadlines remain independent bounds.

Rollback by reverting this PR. No persisted state, migration, protocol version, canonical encoding, business API compatibility promise, or active deployment changes.