[danjboyd]

Summary

Fixes #300 for HTTP request parsing. The shared strict decoder validates percent escapes, UTF-8, and NUL consistently on Apple Foundation and GNUstep. ALNRequest applies it to request targets and URL-encoded form bodies for both the llhttp and legacy parsers, including spooled bodies.

Behavior changes

• Malformed escapes, invalid UTF-8, or decoded NUL in a request target or URL-encoded form body reject the whole HTTP request with 400. Previous core query handling kept the raw invalid component.
• A literal + in a URL query remains +; only URL-encoded form bodies turn + into a space. This changes GET forms sent as application/x-www-form-urlencoded queries. Apps that need a query space should send %20.

No module parser is changed here. The notifications, jobs, admin UI, search, and storage modules still choose their own fallback for invalid components; module adoption remains a separate audit item. ALNSearchModule is owned by arlen-claude.

Verification

• Apple Foundation: ./tools/test_apple_xctest.sh --suite unit --filter RequestTests — 29 passed, zero failures. The same vectors cover the legacy and llhttp backends and live in the cross-platform XCTest suite.
• Apple Foundation: ./tools/test_apple_xctest.sh --suite integration --filter HTTPIntegrationTests/testMalformedPercentEncodingReceivesHTTP400 — one passed, zero failures, using a real local server.
• API reference generator with Homebrew Python 3.14: passed with no generated diff. Docs navigation, inventory ordering, and git diff --check: passed.
• GNUstep vectors await normal PR CI. No GNUstep toolchain is active on this Mac. Full local docs HTML gate is unavailable because pandoc and GNU make are absent.

Draft PR only. No ABI/runtime pin changes, suppressions, exclusions, merge, tag, or publication.