[rennf93]

Closes #83

This brings actix-guard-rs to parity with the Python reference. It needs the engine API from Guard-Core/guard-core-rs#143, so CI stays red until that merges. Merge order: guard-core-rs#143, then this PR (independent of tower and axum).

• exclude_paths uses the engine matcher and a scoped pipeline (ban check, global IP, country and cloud rules, rate limit, then the scoped response pass with metrics, security headers, CORS and the modifier). GuardExclusionScoped marks the request.
• The client resolves through trusted proxies, depth and X-Forwarded-For (with_client_policy), with the 403 Client address could not be determined for a peer-less request under fail_secure; the WebSocket guard takes the same policy.
• from_security_config goes through the engine's shared Wiring (from_security_config_with takes the injected agent), with agent_stats, metrics, the event bus, the cloud refresh and spawn_dynamic_rules wired from the config. The response processor now shares the ban manager with the ban stage, so a return-rule ban is enforced.
• The response pass hands return rules the body when needed, runs the modifier without a processor, and an all-bypass route calls the downstream and applies only the modifier.
• Defects found along the way: the HTTPS stage used the Host header as the connecting peer and trusted X-Forwarded-Proto unconditionally through connection_info(); the IP gate decision was read before the gate ran; a route's auth rules ignored the global auth_verifier.
• Docs: README contradictions on the status route and WebSocket guard, stale version and Makefile notes, docs/api.md, the CHANGELOG.

Not applied: route_resolution_strict (actix resolves routes after the middleware), the request-body part of body_read_timeout, and the redis feature passthrough. The CORS preflight still answers before the pipeline, and usage rules still run before it, unlike the reference.

Gates run locally: check, fmt, clippy, the engine probe build, tests (169 unit, 27 integration, 40 parity, 16 API), docs with -D warnings, the 100% line coverage gate and the MSRV 1.92 check.