test: cover the pure helpers extracted in the CCN-10 sweep

Adds 20 unit tests across three existing files, driven by the
test-quality-reviewer findings recorded in
specs/unworked_review_issues/2026-05-21_121150_manual-validation.md.
The helpers themselves were extracted in the v2.0 CCN-10 sweep with
verbatim behaviour preservation; these tests pin the contracts before
the v2.0 -> master merge.

test/unit/http_utils_test.cpp (+10):
  sanitize_upload_filename — Unix path strip, Windows backslash strip,
  empty string, bare "." and "..", "..-suffix" strip, "."-suffix strip,
  trailing slash, mixed-separator basename. Pins the disk-write gate
  used by process_file_upload / setup_new_upload_file_info.

test/unit/webserver_register_path_prefix_test.cpp (+5):
  normalize_path via the observable should_skip_auth effect — exact
  match served, ".." pop, "." elision, off-skip path blocked with 401,
  excess ".." clamped to root. Pins apply_normalized_segment indirectly
  through its only caller.

test/unit/webserver_on_methods_test.cpp (+3 +2):
  serialize_allow_methods enum-declaration order — Allow header is
  emitted in GET/HEAD/POST/PUT/DELETE/CONNECT/OPTIONS/TRACE/PATCH order
  regardless of registration order (TASK-021 contract).
  upsert_v2_param_route — composition (GET+POST on the same
  parameterized path both served, args bound) and atomicity (failed
  duplicate GET leaves the original handler intact).

specs/unworked_review_issues/2026-05-21_121150_manual-validation.md:
  Record of the validation-loop output (8 agents, 2 iterations). Lists
  the 12 majors + 44 minors that remained advisory after the test
  fixes landed — for follow-up sweeps; not blockers for the v2.0 PR.

Verified locally: full `make check` (68 unit tests, all green).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: etr