Port full Express router and Supertest contracts

Context

The sequential Bun corpus frontier is js/third_party/express/app.router.test.ts at position 3961/4708, following completed esbuild work in #218 and the foundational Express/body-parser work in #214. This contributes to #66.

Current gap

The 1,108-line copied router suite currently stops because supertest is not represented. It covers the Express Router object, all HTTP method helpers, middleware nesting, params and regexp captures, case/strict routing, wildcards, next(route)/next(router), async rejection propagation, URL rewriting, router disposal, headers, and callback completion.

Acceptance criteria

• supertest request chains execute an Express application without a real network listener.
• Router supports use, method routes, nested mount paths, mergeParams, and params restoration.
• String/regexp route matching handles decoding, malformed escapes, case sensitivity, strict slashes, optional/repeated/wildcard parameters, and captures.
• Middleware traversal implements method alteration, next(), next("route"), next("router"), URL rewriting, and disposed layers.
• Sync throws and async rejections flow through Express error middleware with original stack context.
• Supertest validates status, body, JSON, and headers while delivering done exactly once.
• The copied test passes with its existing todos and is pinned in the permanent third-party gate.

Completed on main in 3ccb60d.

The Express compatibility layer is now a shared ordered router engine rather than an exact-path shim: it covers the full Node HTTP method surface, callable Router instances, middleware and route layers, nested mounts, mergeParams (including shifted numeric regexp captures), parameter restoration, decoded/malformed parameters, array/regexp/string paths, case and strict routing, URL rewriting, next("route")/next("router"), same-route error middleware, and disposed-router lookup.

The Supertest adapter executes applications in-memory and supports chained status/body/JSON/header/custom assertions. Completion is guarded so done is delivered once, while assertion failures retain the original application error as cause and include its message and stack.

Verification: focused position 3961 reports files=1, passed=77, todo=45, failed=0, unsupported=0, allowed-empty=0; all permanent copied-corpus, SQL, and third-party gates pass.