docs: document path-scoped middleware and remove em-dashes from prose

[tonydspaniard]

Summary

Documentation-only change. No source changes, no version bump.

• New section in docs/packages/http.md: "Scoping middleware to specific paths". Fills a gap: how to restrict/exclude middleware by request path.
  • RequestPathRule's path (include) / passthrough (exclude) contract for the authentication middleware, with boundary-aware prefix matching (/api matches /api/users/42 but not /apidocs) and AND-combining with RequestMethodRule to let OPTIONS pre-flight through.
  • A copy-paste PathScopedMiddleware decorator (only / except prefix lists) for scoping any non-authentication middleware, since the PSR-15 pipeline is global.
  • Forward link added from the "Authentication and JWT" section.
• Em-dash cleanup. Replaced ~1,330 prose em-dashes with contextual punctuation (parentheses, colons, commas, semicolons) across docs/, README.md, AGENT.md, and CHANGELOG.md. Em-dashes inside code blocks and inline code spans are intentionally left untouched, including the two in docs/packages/tinker.md that document the literal — rendered for a missing count.

Test plan

• Markdown renders correctly (tables, links, and anchors intact after punctuation changes)
• New http.md section anchor (#scoping-middleware-to-specific-paths) resolves from the Authentication and JWT cross-link
• No source/code changes; CI (cs/stan/test) unaffected