- Non-blocking I/O correctness: a request head split across TCP segments is held
  and resumed instead of dispatched truncated; EAGAIN no longer treated as EOF in
  the ws proxy wait, the raw tunnel or POST-body buffering
- WebSocket frame layer: heap-allocated payloads instead of overflowing a fixed
  BUFSIZ buffer, correct byte-swap for 16/32/64-bit extended lengths, split frames
  resumed, 64 MB cap on peer-declared lengths, frame_map down to under 100 KB
- Security: axil_auth() no longer over-reads adjacent descriptor state on an
  over-long username; axil_ws_read/write/printf/close and axil_auth reject
  descriptors outside [0, FD_SETSIZE)
- Handler body is NUL-terminated at Content-Length, so strlen(body) no longer
  reports the previous request's leftovers
- Request head: any method parsed, not just the five known ones; a head past
  64 KiB is answered 431 instead of being stashed on the connection
- axil_respond_file() now defers its body like axil_sendfile(), delivering the
  whole file instead of headers promising a Content-Length with no body
- axil_disconnect() fires for authenticated connections; an unknown user
  inherits the axil_pw identity instead of resolving to uid 0
- Documented the axil_ws_upgrade()/axil_fd_watch() pairing, the ws_read
  EMSGSIZE/EAGAIN contract and the advisory nature of axil_auth()'s return
- Build (macOS): the 64-bit byte-order helpers are ws_htonll/ws_ntohll, since
  Darwin defines htonll/ntohll as macros in <sys/_endian.h> and the definitions
  expanded inside their own declarations
- Tests: proof.sh reports T1-T9 individually (36 checks); both runners claim a
  free port, kill every server they start, and verify body length per request