Add validation auth and module lifecycle support

[rtcoder]

Summary

• Add validation helpers with Validator, ValidationException, typed RequestDto, and #[BodyDto] request binding.
• Return validation failures as JSON 422 responses with field errors.
• Add built-in CORS middleware with preflight handling.
• Add authentication and authorization contracts plus auth middleware implementations.
• Add request attributes for middleware-to-controller state sharing.
• Add module config loading from config.php and getConfig(), expose merged config as modules.config, and add module boot() lifecycle hooks.
• Move the framework source tree from Engine/ to src/ and update Composer autoloading, CLI paths, and CI lint paths.
• Update README, REFACTORING.md, and docs/index.html for validation, DTOs, auth, CORS, module lifecycle, and the src/ layout.
• Expand API core tests for validation, DTO binding, CORS, auth, module config, module boot hooks, and existing runtime flows.

Validation

• composer validate --strict --no-check-publish
• composer dump-autoload
• find src application tests -name '*.php' -print0 | xargs -0 -n1 php -l
• composer test
• php shift.php route:list
• php shift.php health
• HTTP smoke tests:
  • GET /health -> 200 application/json
  • GET /hello -> 404 application/json

Release

• Version label: v0.11.0