[rennf93]

Summary

Aligns the Tornado adapter with fastapi-guard's engine routing.

• Passthrough and the route all-checks bypass go through the engine BypassHandler: a request with no client address gets the fail_secure 403, excluded paths stay scoped (checks still run), and a bypassed route calls the real handler method with the modifier applied.
• SecurityHandler.finish() runs the engine response pass before the response is flushed, instead of on_finish after it was sent. custom_response_modifier, the security headers, CORS and return-rule effects now reach the client, body-based return rules see the buffered body, and global behavior return rules are passed.
• Blocked, preflight and bypass responses skip the response pass, so they emit no request metrics. Excluded paths still reach it.
• Security headers and CORS are no longer reimplemented before the handler. Blocked responses carry CORS only, like fastapi-guard.
• A Redis failure during initialization returns the 503 with Retry-After.
• SecurityMiddleware.apply_pre_flight_headers is removed (it was the reimplemented path), and the docs describe the new flow.
• The guard-core floor moves from >=4.0.0 to >=4.1.0, the first release with the engine APIs used and the floor the other adapters declare.

Streamed responses that call flush() before finish() have their headers on the wire already, so the pass observes them (metrics, return rules over the buffered body) but cannot change them.

Tests

New tests/test_engine_parity.py runs a real Tornado server and client against the real engine handlers. The tests that asserted the old _check_bypass behavior and the removed pre-flight headers are replaced. Full suite with --cov-fail-under=100 and pre-commit run --all-files pass.

Closes #38