feat: middleware bypass overlay (#221)

* **New Features**
  * Routes can promote route-local bypass rules into matching entrypoint middleware, layering route-specific bypasses onto existing entrypoint rules and avoiding duplicate evaluation.

* **Behavior Changes**
  * Entrypoint middleware updates now refresh per-route overlays at runtime; overlay compilation failures result in HTTP 500 (errors are not exposed verbatim).
  * Route middleware accessors now return safe clones.

* **Documentation**
  * Clarified promotion, consumption, merging and qualification semantics with examples.

* **Tests**
  * Added tests covering promotion, cache invalidation, consumption semantics, and error handling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

internal/net/gphttp/middleware/README.md

@@ -11,6 +11,7 @@ This package implements a flexible HTTP middleware system for GoDoxy. Middleware
 - **Middleware Chaining**: Compose multiple middleware in priority order
 - **YAML Composition**: Define middleware chains in configuration files
 - **Bypass Rules**: Skip middleware based on request properties
+- **Entrypoint Overlay Promotion**: Promote route-local middleware entries with `bypass` into matching entrypoint middleware for HTTP routes
 - **Dynamic Loading**: Load middleware definitions from files at runtime
 
 Response body rewriting is only applied to unencoded, text-like content types (for example `text/*`, JSON, YAML, XML). Response status and headers can always be modified.
@@ -140,6 +141,42 @@ type Bypass []rules.RuleOn
 func (b Bypass) ShouldBypass(w http.ResponseWriter, r *http.Request) bool
 ```
 
+For HTTP routes, any route-local middleware entry that sets `bypass` and matches an existing entrypoint middleware name contributes an overlay: its bypass rules are promoted into the effective entrypoint middleware for that route.
+
+Semantics:
+
+- route-local middleware entries may be promoted when they include `bypass`; only the bypass portion is promoted in v1
+- promoted rules are qualified as `route <alias> & <rule>`
+- existing entrypoint bypass rules are preserved and the route rules are appended
+- if the route-local middleware entry is **bypass-only**, it is consumed so the same middleware is not evaluated twice
+- if the route-local middleware entry contains additional options, only the bypass portion is consumed; the rest of the route-local middleware still executes normally
+- if no matching entrypoint middleware exists, route-local middleware behavior is unchanged
+
+Example:
+
+```yaml
+entrypoint:
+  middlewares:
+    - use: oidc
+
+routes:
+  app:
+    middlewares:
+      oidc:
+        bypass:
+          - path glob("/public/*")
+```
+
+Effective behavior for route `app` is equivalent to:
+
+```yaml
+entrypoint:
+  middlewares:
+    - use: oidc
+      bypass:
+        - route app & path glob("/public/*")
+```
+
 ## Available Middleware
 
 | Name                            | Type     | Description                                |
@@ -247,6 +284,8 @@ if err != nil {
 }
 ```
 
+`PatchReverseProxy` still handles route-local middleware in the normal way. Entrypoint overlay promotion happens earlier, at entrypoint request dispatch time, where the server has both the resolved route and the raw entrypoint middleware definitions available.
+
 ### Bypass Rules
 
 ```go