feat(pipeline): reference parity for exclude_paths, client resolution, config wiring and the response pass

[rennf93]

Closes #84

This brings rocket-guard-rs to parity with the Python reference. It needs the engine API from Guard-Core/guard-core-rs#143, so CI stays red until that merges. Merge order: guard-core-rs#143, then this PR (independent of the other adapters).

• exclude_paths uses the engine matcher and a scoped pipeline (ban check, global IP, country and cloud rules, rate limit, then the scoped response pass). GuardExclusionScoped is a request guard. The CORS preflight runs before the exclusion decision.
• The client now resolves from the connecting peer through ClientPolicy (trusted proxies, depth, X-Forwarded-For, with_client_policy) instead of Rocket's client_ip(), which honors X-Real-IP from any peer. A peer-less request gets 403 Client address could not be determined under fail_secure; the WebSocket guard takes the same policy.
• from_security_config goes through the engine's shared Wiring (from_security_config_with takes the injected agent), with live agent_stats, metrics, the event bus, the cloud refresh and spawn_dynamic_rules. The response processor shares the ban manager with the ban stage.
• The response pass hands return rules the buffered body (bounded by body_read_timeout, 500 on error), runs the modifier without a processor, and an all-bypass route calls the downstream and applies only the modifier.
• Defects found along the way: the HTTPS stage got no connecting peer and a hardcoded scheme, so a forged forwarded proto was believed; the global auth_verifier was not the fallback for route auth rules.
• Docs: the stale scaffold text in the skill file is rewritten, plus README, docs/api.md, AGENTS.md, CLAUDE.md, Cargo.toml and the CHANGELOG.

Not applied: route_resolution_strict (Rocket resolves routes after on_request) and the request-body part of body_read_timeout. The TLS listener path is untested because the tls feature is off.

Gates run locally: check, fmt, clippy (also the workspace), the engine probe build, tests (152 unit, 45 integration, 39 parity, 18 API), docs with -D warnings and the 100% line coverage gate. I did not run the MSRV job here.