//! Optional axum/tower middleware that sits outside the core auth flow:
//! request ID, W3C trace context, rate limiting, CSRF.
//!
//! Each middleware is independently useful; adopters mix and match.
/// `X-Request-Id` middleware (`request-id` feature).
/// W3C Trace Context (`traceparent`) middleware (`trace-id` feature).
/// Composable token-bucket rate limiting.
/// CSRF protection (signed double-submit cookie).
/// WebSocket helpers: revocation-aware connection wrapper (`ws` feature).