A supplied default now narrows the return type, so a call site that passes one
no longer needs a fallback for a branch that cannot happen:

  request.param('id', '')        string, not string | undefined
  request.header(k, d)           string
  request.cookie(n, d)           string
  request.encryptedCookie(n, d)  string
  request.plainCookie<T>(n, d)   T
  config.get<T>(k, d)            T
  env(k, d)                      string

Runtime is unchanged and the overloads only narrow, so nothing that compiled
before stops compiling.

Also documents what the catch-all array costs the type of ctx.params, and
points it at request.param() — which already returns string | undefined and
joins a catch-all with a slash, so an app does not need its own accessor.