v0.2.12 — HTTP contracts, testable requests and optional PDO

HTTP routing now distinguishes an unknown path (404) from an unsupported method (405 with Allow). HEAD prefers an explicit route and otherwise uses GET without emitting content. Automatic OPTIONS returns 204 with Allow for known paths without invoking a controller; explicit OPTIONS routes still run normally. This does not configure CORS.

App::handle(ServerRequestInterface $request): ResponseInterface processes a supplied request without output or process exit. Sequential calls replace request bindings and matched-route state while retaining shared application services. Existing applications continue to start with app()->run(); adopting handle() is optional. Response preparation suppresses content for HEAD, informational statuses, 204, 205 and 304 and is reapplied after header listeners.

The core no longer requires PDO. Database integrations still need PDO and their drivers. Both built-in containers implement the new MutableContainerInterface; App and AutoResolvingContainer require it directly in their constructor types. Dispatcher execution and route URL lookup are simplified, numeric route names remain strings, and method normalization is consistent for automatic OPTIONS and the welcome response.

Request creation also preserves the browser authority from Host without adding an internal container listen port. An explicit public port is retained, and the request contains exactly one Host header. This includes the previously merged authority correction; there was no separate 0.2.11 release.

Upgrade notes:

• Custom writable containers must implement Naf\Contracts\MutableContainerInterface, extending PSR-11 with set() and reset(). Unsupported containers fail with PHP's TypeError before boot.
• Every URL placeholder must receive a string or integer. Missing or invalid values throw InvalidArgumentException. Encoding remains the caller's responsibility; values are substituted once.
• Handlers must return PSR-7 responses. The undocumented -1 exit sentinel is rejected instead of terminating in-process handling.
• GET handlers can also serve HEAD. Register explicit HEAD or OPTIONS routes where separate application behavior is needed.
• Nyholm PSR-7 now requires 1.8.2 or newer to avoid PHP 8.4/8.5 deprecations at the minimum dependency set.

Event::REQUEST_BODY and Event::REQUEST_END remain defined as deprecated compatibility constants; the core does not dispatch them. AppHolder, CoreFileLoader, PluginBootOrder and Stopwatch are marked internal.

Validation: 201 tests / 504 assertions, PHPStan, strict Composer validation, real HTTP and published-plugin integration tests. All eight CI jobs pass on the release commit, covering PHP 8.3/8.4/8.5 with lowest/latest dependencies, the locked set and production installation without PDO.