feat: unify the HTTP request contract across backends

[oboard]

Problem

The three HTTP backends (native, JS/Node, mongoose C) produced materially different HttpRequest values for the same request, so application behavior depended on which backend a deployment used:

• Query strings — native stripped ?query before dispatch, so the handler could not recover it; JS routed against the raw req.url (path + query), so GET /hello?x=1 returned 404 against a registered GET /hello route.
• PUT/PATCH bodies — native read bodies for POST/PUT/PATCH and framed requests; JS only read a body when the method was exactly POST, so PUT/PATCH reached handlers with an empty raw_body.
• Header casing — headers were a case-sensitive Map[StringView, StringView]. Node lowercases incoming keys while native preserves wire casing, so event.req.headers.get("X-Test") behaved differently per backend even though HTTP field names are case-insensitive (per RFC 9110 §5.1).

Additionally, the JS adapter did its own inline dispatch rather than reusing the shared dispatch_http, so the JS serve path was not covered by in-process dispatch tests.

What changed

Define one backend-independent request contract:

• Path + query separation — dispatch_http now splits the request-target into a pure path (used for route matching and static-asset resolution) and a separately-retained HttpRequest.query. A ?query can no longer 404 a registered route; the handler can recover it.
• Shared request_has_body predicate — drives body reading identically for the native and JS adapters: always for POST/PUT/PATCH, or when a body is framed via content-length / transfer-encoding.
• Case-insensitive headers — HttpRequest.headers and HttpResponse.headers are now to-owned, case-insensitive Map[@http.CaseInsensitiveString, StringView]. Because CaseInsensitiveString is implicitly convertible from String/string literals, existing call sites (map literals, .get/.set/[...]) compile unchanged while lookups become case-insensitive. The mongoose adapter's parse_headers returns the same type.
• JS adapter now funnels through the shared dispatch_http — reusing shared routing, body reading, and error handling, so the JS serve path conforms to the same contract.

Conformance suite

request_conformance.mbt adds 6 tests that run on both the +js and +native targets (the workspace compiles/runs dispatch_http tests per-target). They assert:

• Query strings do not break path routing.
• Path and query are exposed separately.
• Fragments are stripped from the query.
• A query-free request yields an empty query string.
• PUT and PATCH bodies reach the handler (body-method parity).
• Request headers are case-insensitive.

Verification

• moon check clean on both +js and +native targets.
• moon test passes on both targets (67 native, 73 js).
• Live smoke test — a small server with a GET route and a PUT echo handler, run twice:

Request	native	js
GET /hello/moonbit?x=1&y=2	path=/hello/moonbit query=x=1&y=2	path=/hello/moonbit query=x=1&y=2
PUT /echo/42 body + x-test: abc (then X-Test: MIXED, X-TEST: CAPS)	body=payload-body header=abc	body=payload-body header=abc (then MIXED, CAPS)

Identical on both backends.

🤖 Generated with Claude Code