Update for the middleware ABI minor 3 vhost_id / KV-scope change

[luthermonson]

Downstream half of ephpm/ephpm#449.

Unblocked and re-pinned. ephpm/ephpm#448 merged to main as 691e6fef and
shipped in v0.8.9. The rev here now points at c2774ab6 — the commit
tagged v0.8.9 — not at #448's PR-branch head 21a7c8a7, which never landed on
main (the PR was squash-merged) and would have become unfetchable once the
branch was deleted. Pinning the released tag's commit keeps the pin immutable
while guaranteeing these examples build against an ABI that actually shipped in
a host binary operators can run. No API drift between the two revs: the only
changes to the consumed crates are docs plus a !Send marker on the host-side
SiteKvScope, which nothing here uses.

What changed upstream

ePHPm #448 takes the native-middleware ABI to minor 3 and redefines two
surfaces rather than only appending to them:

• Request::vhost_id() returns Option<&str> carrying the router's
  canonical site key, None for a host that matched no vhost — where it
  used to return the raw Host header, un-normalized and never absent
  (ephpm#390).
• the host table's kv_* callbacks resolve the serving vhost's keyspace
  instead of the process-global store, with the global store reachable through
  the appended kv_*_global slots (ephpm#376).

What that meant here

Nothing failed to compile — none of the four examples called vhost_id(),
and I verified that at the new pin before changing anything. But two of them
were teaching the wrong thing once the host changed underneath them.

api-key — the credential map moves to the global store

kv_key_template maps apikey:<secret> → consumer id. Under minor 3 a plain
kv_get reads the serving tenant's own store — the one that tenant's PHP
writes through ephpm_kv_set(). On a multi-tenant node any tenant could then
write apikey:<anything> and mint itself a consumer identity this gate would
honour. So the lookup moves to kv_get_global.

Worth being clear that this is not a behaviour change: the global store is
exactly where kv_get went before minor 3. It is the change that keeps the
example correct, not one that alters it.

api-key — an optional <site>, and the fail-closed pattern

Since one mount serves every vhost, a multi-tenant deployment usually wants one
key map per tenant. kv_key_template gains an optional <site> placeholder
(apikey:<site>:<key>) resolved from vhost_id(), and it denies when there
is no tenant rather than substituting anything — the fail-closed half of the
pattern, as against the deliberate UNMATCHED_VHOST bucket that ratelimit and
maintenance-mode use in-tree. Three tests: per-tenant isolation, the
fail-closed branch, and a template without <site> staying node-wide.

Site substitution happens before key substitution, deliberately: the presented
key is client input, so doing it the other way round would let a caller inject a
literal <site> for the next replace to expand.

redirect — the one place reading Host is right

Documented why: a canonicalizing redirect exists to rewrite what the client
asked for, which is exactly the thing vhost_id() is not. Also dropped a stale
claim that the ABI exposes no request scheme — minor 2 added req.scheme() /
req.is_secure(), and the example keeps the header-derived form on purpose (it
also has to preserve the request's port, which http_host() strips).

README

A Tenancy section with both patterns and the kv_* / kv_*_global split,
plus the ABI minor history.

A test-isolation bug found on the way

Adding setup_kv_with callers made three api-key tests fail ~100% of the time
in parallel and pass serially. Cause: the store is process-wide, and
Store::set_local removes the old entry before inserting the new one, so
two tests seeding the same key name left a window where a third read saw a miss.
Fixed by isolating the key names — the interference is the bug, not the timing.

Verification

Re-verified against the v0.8.9 pin before merge:

• The escalation is real and the fix is the right one. abi.rs at v0.8.9 states
  both halves independently: the kv_* slots resolve the serving vhost's
  keyspace and "shares a keyspace with the tenant's ephpm_kv_*", and the
  global slots are where "operator-owned state lives, out of reach of any
  tenant's PHP".
• All five kv_*_global wrappers the README names really exist
  (kv_get_global, kv_set_global, kv_set_nx_global, kv_incr_global,
  kv_incr_ttl_global) — no phantom API.
• request_host is documented port-stripped, so redirect's stated reason for
  keeping the raw header holds.

CI green on the re-pinned commit 79ad4fc: fmt, clippy, test, release build.