test(03-04): cover framework database, routing and JWT boundaries

- Shared pgx/GORM pool, ICU locale fail, and isolated plugin migrations
- Seven-stage middleware order, missing-guard boot failure, typed 404s
- Adversarial JWT matrix including alg:none, empty secret, and no leak

Co-authored-by: Cursor <cursoragent@cursor.com>

examples/hello/hello_test.go

@@ -153,8 +153,11 @@ func TestHelpListsServe(t *testing.T) {
 	if err := run([]string{"--help"}, &buf); err != nil {
 		t.Fatal(err)
 	}
-	if !strings.Contains(buf.String(), "serve") {
-		t.Fatalf("help missing serve:\n%s", buf.String())
+	help := buf.String()
+	for _, name := range []string{"serve", "migrate", "migrate:status", "migrate:rollback"} {
+		if !strings.Contains(help, name) {
+			t.Fatalf("help missing %s:\n%s", name, help)
+		}
 	}
 }