feat: four-point hook SPI (incoming, pre-storage, post-commit, outgoing)

[degoke]

Item 3 of the HAPI-inspired build list: a small hook SPI so people can extend HAIStack without forking. Four pointcuts only — not HAPI’s interceptor bus.

Points

Point	Where	Can abort?	Can mutate resource?
incoming	HTTP, after routing, before the handler	yes	no (body may not be parsed yet)
pre-storage	core write path, after validation, before version stamp/persist	yes	yes
post-commit	core, after the write session commits	no (errors are ignored so a successful write is not reported as failure)	observe only
outgoing	HTTP, before a resource envelope is serialized	yes	yes

Register with hooks.NewRegistry().On(point, fn) and pass the same registry to core and HTTP via runtime.Builder.WithHooks.

Unknown points are rejected at registration. Hooks run in order; the first error stops the chain.

Tests

• Registry order/stop/mutate in pkg/hooks
• Pre-storage reject + mutate, post-commit observe-without-fail in pkg/core
• Incoming reject and outgoing mutation in pkg/http