[codex] Add negotiated response compression

[pq198363-ops]

Fixes #94.

Summary

• adds standard negotiated response compression after request-id and security-header middleware
• supports COMPRESSION=off and COMPRESSION_THRESHOLD_BYTES runtime controls
• keeps /api/v1/metrics uncompressed so the Prometheus text exposition remains predictable
• preserves services ETag/304 revalidation and CSV download headers while compressing large list/export responses
• documents compression defaults and the BREACH-style caveat for future secret-bearing responses

Verification

• RED: npm run build; $env:NODE_ENV='test'; node --test dist/compression.test.js failed before implementation because large service-list and CSV export responses had no Content-Encoding: gzip.
• GREEN focused: npm run build; $env:NODE_ENV='test'; node --test dist/compression.test.js passed 7 tests.
• npx prettier --check README.md src/middleware/index.ts src/compression.test.ts package.json package-lock.json
• npm run lint
• clean dist/, then npm run build
• $env:NODE_ENV='test'; node --test dist/*.test.js dist/**/*.test.js passed 96 tests across 11 suites.
• git diff --check

Security note

Compression is scoped to public API responses and can be disabled with COMPRESSION=off. Metrics remain uncompressed, and the README calls out that secret-bearing/reflected-input responses should not be added to the compressible surface without rechecking BREACH-style side-channel risk.