max / makenotwork

Bump the tower/axum middleware cluster (server, kberg) tower-http 0.6 -> 0.7, tower_governor 0.6 -> 0.8, governor 0.8 -> 0.10.4, axum-extra 0.10 -> 0.12.6, as one batch so the layer types stay compatible. kberg's tower-http moves in the same commit; it was held back deliberately to stay in step with the server. tower-sessions 0.14 -> 0.15 is NOT here and stays blocked upstream: tower-sessions-sqlx-store 0.15.0 is still the newest release and still builds against tower-sessions-core 0.14, so PostgresStore would not implement the 0.15 SessionStore trait. Rechecked against crates.io today. Same crate blocks the sqlx 0.9 task. Only code change: tower_governor made GovernorLayer's fields private, so 37 `GovernorLayer { config }` literals across 12 route modules became GovernorLayer::new(config). 36 were a mechanical rewrite; the last one wraps a multi-argument call and was done by hand. A mechanical rewrite at that scale can compile and still be wrong, so the behavior was checked rather than assumed: the rate-limiting suite confirms burst still trips, Retry-After is still emitted, and per-IP limits stay independent. axum-extra crossing two majors puts the cookie layer at risk too, so the session, login, and CSRF workflows were run as a group (45 tests). Full suite: 1889 lib + 1190 integration green, clippy clean at --all-targets --all-features. kberg's lock now carries tower-http twice; the 0.6.11 copy is reqwest 0.13.4's own dependency, not ours to move.