feat: add request bins for inspecting captured HTTP requests

[jaredwray]

Summary

Adds requestbin.net-style request bins to mockhttp. Users mint an ephemeral URL, send arbitrary HTTP requests to it (any method, sub-path, or body), and read back what was received — useful for webhook debugging.

• Management API under /bins/* — create, list, get, delete bins; list/get/clear captured requests
• Capture endpoint at /b/:id and /b/:id/* records method, headers, query, body (utf8 for text, base64 for binary), IP, content-type, size, and a truncation flag
• BinManager with a pluggable BinStore interface (InMemoryBinStore is the default — Redis/SQLite can plug in later without breaking changes). Configurable TTL (24h default), per-bin request cap (100, FIFO drop), and body size cap (1 MiB, truncate + flag).
• Cleanup timer is unref()'d and stopped on server close() so it can never keep the Node process alive.
• rewriteUrl now treats wildcard routes that also have non-wildcard params (like /b/:id/*) as specific, so subpath captures don't get rewritten away. Pure catch-all /* routes still defer to more specific prefix matches (existing behavior preserved).

Endpoints

Method	Path	Description
POST	/bins	Create a new bin
GET	/bins	List active bins
GET	/bins/:id	Get bin metadata
GET	/bins/:id/requests	List captured requests (newest first)
GET	/bins/:id/requests/:reqId	Get a single captured request
DELETE	/bins/:id/requests	Clear all captured requests in a bin
DELETE	/bins/:id	Delete a bin
ANY	/b/:id and /b/:id/*	Capture any request sent to a bin

Quick example

ID=$(curl -s -X POST http://localhost:3000/bins | jq -r .id)
curl -X POST "http://localhost:3000/b/$ID/webhook?source=stripe" \
  -H 'content-type: application/json' \
  -d '{"event":"payment.succeeded"}'
curl http://localhost:3000/bins/$ID/requests | jq

Test plan

• pnpm test — 463 tests pass, lint clean
• New files have 100% coverage; overall coverage unchanged from baseline (99.73%)
• Smoke-tested via curl: bin create, JSON POST capture, binary PUT capture (round-trips through base64), HEAD capture, sub-path + query capture, list, get single, delete bin → 404
• Swagger UI at /docs shows the new Bins tag with all seven management endpoints plus the capture route
• Existing rewriteUrl test "prefers a specific route over a wildcard catch-all" still passes — pure /* fallback semantics preserved

---

Generated by Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (6524834) to head (02ef71f).

Additional details and impacted files

@@            Coverage Diff             @@
##              main      #150    +/-   ##
==========================================
  Coverage   100.00%   100.00%            
==========================================
  Files           37        41     +4     
  Lines         1089      1310   +221     
  Branches       222       259    +37     
==========================================
+ Hits          1089      1310   +221     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[gemini-code-assist]

Code Review

This pull request implements Request Bins, allowing users to capture and inspect incoming HTTP requests through ephemeral URL endpoints. The update includes a BinManager for lifecycle operations, a pluggable storage system with an in-memory default, and new Fastify routes for management and request capture. Review feedback highlighted the need for robust input validation in the BinManager constructor and defensive loop conditions in the storage layer to prevent potential runtime issues with negative configuration values.