[codex] Emit Server-Timing before response flush

[pq198363-ops]

Summary

Closes #147.

This fixes the request timer so Server-Timing is emitted before response headers are flushed. The previous implementation tried to set the header inside the finish handler, which runs after the response has already been written, so clients never received the header.

Changes

• Move the request timer into the pre-route middleware path so metrics and other early routes are covered.
• Wrap res.writeHead to set Server-Timing: app;dur=... before headers flush.
• Keep the existing structured completion log on finish.
• Add regression tests for JSON, CSV, Prometheus metrics, and empty 304 responses.
• Document the observability header and its coarse-duration security boundary.

Verification

RED before implementation:

node --test dist/server-timing.test.js
tests 4
pass 0
fail 4
failure: Server-Timing header missing

GREEN after implementation:

npm run build
NODE_ENV=test node --test dist/server-timing.test.js
tests 4
pass 4
fail 0

NODE_ENV=test node --test dist/*.test.js dist/**/*.test.js
tests 93
pass 93
fail 0

npm run lint
npx prettier --check README.md src/middleware/index.ts src/server-timing.test.ts
git diff --check

Note: on Windows I ran the direct NODE_ENV=test node --test ... equivalent after npm run build because the package npm test script uses POSIX-style NODE_ENV=test syntax.