Simplify CPEX hooks with operation modules and typed request state

[lucarlig]

Tool, prompt, and resource hooks repeated CMF conversion plumbing and passed erased request state through two runtime layers. This refactor groups each operation with its conversions and gives in-flight requests typed state that owns the selected runtime.

• Split tool, prompt, and resource adapters and their conversion tests into separate modules.
• Share pre-hook execution and use one internal CmfResponse trait for post-hook projection and application. Preserve each operation's existing conversion and rejection rules.
• Replace Any state and registry wrappers with typed states. Tool events and the final response share one mutex; prompt and resource state is owned directly. Migrate gateway callers to invoke post-hooks through their captured state.
• Unify argument updates, supported-hook discovery, and config reload handling. Remove the separate pipeline module and unnecessary runtime plumbing from the backend client.

Requests retain their original hook policy across successful or failed reloads. Resource URI authorization, text/blob conversion, metadata preservation, prompt validation, and denial behavior are unchanged. The routing wiki documents the new module boundaries.

Validation: 242 all-feature workspace tests passed, with 13 existing skips; all-feature Clippy and build, formatting, dependency/license audit, cargo shear, wiki build/test, and repository commit hooks passed. Added coverage for all pre/post hook combinations across the three operations, prompt context after a failed reload, concurrent tool events after reload, and releasing a retired runtime when the last request state is dropped.

Dataplane-only end-to-end verification passed against release images of base d768052 and PR head c2b4d4d: 27 functional cases and 24 concurrent requests per image, with identical JSON-RPC responses. The test used real Redis and a local stateless MCP 2026-07-28 backend directly, without dev-tools or a control plane. It checked tool/prompt argument redaction, tool/resource response redaction, pre-hook denial before backend access, post-hook denial, disabled plugins, metadata and binary preservation, backend errors, unpublished-route rejection, and concurrent request isolation. All temporary test containers and networks were removed. Full-stack, sustained load, and conformance testing are outside this focused verification.

Follows up on Dawid's refactoring suggestion. Based on main; no new dependencies.