fix: support JavaScript Express guards

[ejntaylor]

What changed

• generate runtime guards that match Express entry files: guard.ts, guard.js, or guard.cjs
• preserve required file extensions for directly executed ESM and CommonJS applications
• register the parsed-body Express guard after express.json() and before routes
• leave the application source untouched and report not-wired when the required body-parser anchor is absent
• verify the generated JavaScript and CommonJS syntax with Node

Why

Bolt commonly generates a plain ESM server.js. The existing Express adapter always scaffolded guard.ts, inserted an extensionless import, and registered raw-stream middleware before express.json(). That shape could not run under Node and could consume the request before Express parsed {text}.

Impact

The Express todo application used by the Patchstack virtual-patching walkthrough can now be wired by patchstack-connect protect without manual middleware. TypeScript and CommonJS Express projects retain module-format-correct output.

Validation

• npm run typecheck
• npm test — 41 files, 473 tests passed
• npm run build
• exact Bolt ESM server.js fixture, CommonJS fixture, idempotency, middleware ordering, missing-parser fallback, and Node syntax checks

Dependency

This PR is stacked on #86 because the JavaScript guard also consumes the shared site-UUID baking added there. Merge #86 first, then retarget this PR to main.

[coderbuds]

Adds Express guard support and production-backed demo with extensive tests.

🎯 Quality: 100% Elite · 📦 Size: Large — consider splitting if possible

📈 This month: Your 235th PR — above team average · Averaging Excellent

_{See how your team is trending →}

[ejntaylor]

/review