Add enforced V2 schemas, CBOR/COSE, and the optimized request path

[crimson-knight]

What changed

• add automatically enforced request and response schema contracts with typed access
• generate OpenAPI 3.1 request, response, parameter, conditional, nested, and cross-field relationships from those contracts
• add bounded deterministic CBOR and bidirectional authenticated COSE Encrypt0 support
• return explicit 400, 406, 415, 422, 500, and 503 contract errors for the relevant failure modes
• integrate the measured span-router, request, params, pipeline, and responder allocation improvements into the V2 release branch
• publish exact-file-location schema and migration guides plus retained cloud benchmark evidence

Compatibility

The existing params.validation API remains functional and is only deprecated. This preserves the intended upgrade path: V1 applications can move to V2 first, then adopt controller schemas one action at a time. The docs state that removal will be no earlier than a later V2 minor such as 2.5, with the exact release announced separately.

Why

The previous schema surface did not consistently enforce declared request contracts, did not validate response shape/status, and could not provide the typed contract needed for dependable OpenAPI generation. The optimized router work also lived on an older experimental line instead of the V2 release branch.

This PR makes the new contract real while preserving the old validation path for backwards compatibility.

Validation

• focused router, params, responder, schema, CBOR, COSE, and OpenAPI suite: 473 examples, 0 failures
• complete Amber suite: 2,401 examples, 0 failures
• all 25 legacy validation examples still pass and emit the intended deprecation warning
• exact DigitalOcean $4 target, 7 rotating repetitions per scenario, 28 raw runs:
  • validated JSON median: 19,488 completed HTTP requests/second
  • validated CBOR median: 21,742 completed HTTP requests/second
  • bidirectional COSE median: 14,443 completed HTTP requests/second
  • 7,974,608 HTTP 200 responses, 100% success, no unexpected error categories
• both temporary droplets and the isolated VPC were destroyed and their absence verified

See the human-readable Round 27 report for method, before/after results, evidence paths, and claim boundaries.

Benchmark boundary

This is a synthetic in-memory acknowledgement workload without a database, TLS termination, external services, HTML rendering, or public-internet latency. The Round 26 to Round 27 delta covers the complete integrated performance patch set, not the router alone.