fix(server,grpc): continue inbound W3C traces in HTTP middleware

[jasoet]

Problem

Both HTTP tracing middlewares started their server span from the raw request context:

ctx, span := tracer.Start(req.Context(), ...)   // server/otel_middleware.go
ctx, span := tracer.Start(ctx, ...)             // grpc gateway

No Extract, so an inbound traceparent header was discarded and every server span became a new root.

This is inconsistent within the library itself:

path	behaviour
rest client outbound	injects traceparent ✅
grpc unary/stream interceptors	extracts ✅
server HTTP middleware	dropped ❌
grpc gateway HTTP middleware	dropped ❌

So a rest → server call made with this library on both ends rendered as two disconnected traces.

Change

Extract W3C trace context + baggage from request headers before starting the span, reusing the composite propagator the gRPC interceptors already use. With no inbound headers this is a no-op and the span is still a root.

Tests (written first, observed failing)

New tests assert the span joins the caller's trace. Before the fix:

expected: "4bf92f3577b34da6a3ce929d0e0e4736"
actual  : "a1be0badcd4d1db205624bba8acf1c48"   <- fresh root
expected: "00f067aa0ba902b7"
actual  : "0000000000000000"                   <- no parent

Added for both packages, plus a companion test pinning the no-header case to a root span so the fix can't regress into always-remote-parent.

Verification

task ci:check — all packages pass, golangci-lint 0 issues. go vet -tags='example integration argo' ./... clean.

Note for the migration guide

Existing users gain correctly-parented server spans. Traces that previously appeared as separate roots will now join their caller — a visible change in any tracing backend, in the correct direction. Closes the "Shared gap (server + grpc)" item in docs/plans/2026-07-22-v3-audit-backlog.md.