test(03-04): cover framework database, routing and JWT boundaries

- Shared pgx/GORM pool, ICU locale fail, and isolated plugin migrations
- Seven-stage middleware order, missing-guard boot failure, typed 404s
- Adversarial JWT matrix including alg:none, empty secret, and no leak

Co-authored-by: Cursor <cursoragent@cursor.com>

surf/params_test.go

@@ -21,6 +21,13 @@ func TestIntParamMalformedIsFalse(t *testing.T) {
 	if _, ok := IntParam(req, "id"); ok {
 		t.Fatal("non-positive id must be false")
 	}
+	req.SetPathValue("id", "")
+	if _, ok := IntParam(req, "id"); ok {
+		t.Fatal("missing id must be false")
+	}
+	if _, ok := IntParam(nil, "id"); ok {
+		t.Fatal("nil request must be false")
+	}
 }
 
 func TestRegexCompilesAtRegistration(t *testing.T) {