feat: add request-based access policy to shared server boundaries #467

Request

Add an independent, server-side request access policy to initDevframe and initHub.
Vite DevTools needs this prerequisite before it can expose an internal-IP allowlist and an async enabled callback safely.

Why Upstream

DevFrames 1.2.6 owns the shared HTTP handler, sidecar and shared-server WebSocket bindings, SSE RPC, and aggregate MCP route.
Wrapping Vite middleware alone leaves the sidecar and other transports outside the policy.
Bring-your-own-context integrations also serve connection metadata outside the hub base, so they need a reusable authorization helper.

Proposed Contract

access: { internalIPs?: readonly string[], authorize?: ({ remoteAddress }: RequestAccessContext) => boolean | Promise<boolean> }

The address comes from the connected peer. Forwarding headers do not participate.
Both restrictions must pass. Empty allowlists deny everyone. Missing peer metadata fails closed.
The callback runs during authorization, after initialization. Errors remain visible with their cause.
The policy applies before HTTP routing and WebSocket admission, and before each inbound WebSocket message.
It also covers SSE requests and enabled MCP routes, without replacing their existing origin or identity checks.

Downstream Vite Behavior

Trusted tokens, build capability tokens, clientAuth: false, and the authentication-disable environment variable must never bypass restrictions.
Live standalone servers need the same boundary. Static build files need access control from their serving web server.
MCP retains its own authorization after the request gate.

Verification

Test defaults, normalization, missing peers, empty lists, callback errors, combined rules, spoofed headers, HTTP discovery/bootstrap, WebSocket upgrades/messages, SSE, and MCP.
Keep the Vite public API blocked until the complete prerequisite is available.