Bundle middleware.ts into the server entry at build time via generateServerEntry().
The virtual module now imports the middleware file statically and exports a
runMiddleware(request) function that includes matcher logic and NextRequest wrapping.

In prod-server.ts, middleware runs before API route and page routing:
- Redirects (e.g. /old-page -> /about) return 307 with Location header
- Rewrites (e.g. /rewritten -> /ssr) transparently serve the target page
- Blocks (e.g. /blocked -> 403) return the middleware Response directly
- Response headers from NextResponse.next() are applied to all matched requests

Also fixes server.listen() to be awaited (enables port: 0 for tests).

When no middleware.ts exists, runMiddleware is a no-op stub.

App Router middleware already works (bundled in RSC entry) — no changes needed.

12 new tests: 6 unit tests for runMiddleware exports, 6 integration tests
using startProdServer with the pages-basic fixture.

Closes #5

- Bug cloudflare#2: hybrid build skipped Pages Router pre-rendering when App Router entry
  also present — fix: only bail out on pure App Router builds (no pages entry)
- Bug #1: getOutputPath traversal guard bypassed on Windows by backslash urlPath
  — fix: reject urlPath containing backslashes before posix normalize
- Bug cloudflare#4: double-counting in result.skipped when AbortController fires and
  res.text() throws — fix: replace await res.text() with res.body?.cancel()
- Bug cloudflare#6: dynamic routes without getStaticPaths/generateStaticParams classified
  as 'ssr' — fix: use 'unknown' (skipped for unenumerable params, not SSR APIs)
- Bug cloudflare#3: routes that throw in ssrLoadModule silently omitted from
  routeClassifications — fix: wrap in try/catch, add 'unknown' classification
- Bug cloudflare#5: buildReportRows ignored knownRoutes for API routes — fix: check
  known?.get(route.pattern) first, fall back to 'api'
- Bug cloudflare#7: dead !Array.isArray guard after try/catch in expandDynamicAppRoute
  — remove unreachable branch
- Bug cloudflare#8: middlewareHeaders spread onto 200 pre-rendered response could include
  Location header — fix: filter out 'location' before spreading
- Bug cloudflare#9: configOverride typed as Partial<NextConfig> allows unsafe non-scalar
  fields — narrow to Pick<NextConfig, 'output' | 'trailingSlash'>