v0.6.3 — global body limit, error hook, fuzz tests

Security

• Global body limit — SetMaxBodySize now enforced for ALL handlers in ServeHTTP (was generic-only). Plain handlers via router.Handle() were previously unlimited.

Added

• SetErrorLogger(func(error, *http.Request)) — hook for unclassified errors before 500. Fires even on partially-written responses (streaming failures). Does NOT fire on classified errors (Problem, ValidationErrors, etc.)
• Fuzz tests — FuzzRadixLookup + FuzzRoutePattern (~3.3M executions, no panics)

Changed

• Body limit applies to plain handlers — existing Handle() endpoints accepting bodies >4MB will get 413. Use SetMaxBodySize(0) to disable.

Fixed

• CORS docs: must be registered before auth middleware

Full Changelog: v0.6.2...v0.6.3