fix: NOD-002 source fix - middleware returns boolean, nextApiHandler checks before proxy

[mrnicholasbcarter-code]

Summary

Implements source-level fix for NOD-002: middleware now returns boolean to signal whether the request should continue, and nextApiHandler checks this return value before calling proxy().

Changes

• src/index.ts:

  • createExpressMiddleware() and createNextMiddleware() now return boolean from inner middleware (true = continue, false = response already written)
  • createNextApiHandler() checks middleware return value before calling proxy(), fixing the fail-open defect where Next.js continued to upstream after 503

• tests/router.test.ts:

  • Added regression test: "returns 503 and does NOT call upstream when Core decision unavailable (requireCoreDecision=true)" - verifies no upstream fetch when middleware writes 503
  • Added regression test: "returns 503 and does NOT call upstream when middleware rejects request" - verifies fail-closed behavior for validation failures

Validation

• All 179 tests pass
• TypeScript build succeeds
• Typecheck passes
• verify:package passes
• Prettier formatting applied

Related

Addresses NOD-002 enforcement gap documented in ADR-001 and node-doc-authority PR #44.