TypeScript: implement AdonisJS routing, middleware, HttpContext, and Lucid support

[bjcorder]

Parent

Part of #89.

Context

AdonisJS is a full-featured TypeScript/Node framework with routing, controllers, middleware, validators, auth, HttpContext, and Lucid ORM. It deserves an integrated framework + data-layer issue because Lucid and Adonis runtime conventions are tightly coupled.

References:

• Routing: https://docs.adonisjs.com/guides/basics/routing
• Middleware: https://docs.adonisjs.com/guides/basics/middleware
• Lucid ORM: https://docs.adonisjs.com/guides/database/lucid

Scope

• Discover Adonis routes, route groups, prefixes, middleware, controller handlers, resource routes, route params, domain routing where feasible, and controller imports.
• Extract request sources from HttpContext, request.input, request.only, request.all, request.param, request.qs, files, headers, cookies, and validator outputs.
• Normalize middleware/auth evidence from route middleware, named middleware, auth, policies, bouncer/authorization patterns, validators, current user/tenant context, and configured helpers.
• Detect Lucid model/query-builder operations: find, findOrFail, query, where, first, create, save, merge, update, delete, related, transactions, and raw query builder patterns.
• Extract resource/model/table, operation type, filters, mutation fields, bulk flag, spans, and normalized sink expression.
• Integrate route-to-service tracing through controllers, services, models, and repositories.

Acceptance Criteria

• Adonis unsafe fixtures emit expected findings for unscoped access, unsafe request-controlled mutations, missing authorization, and bulk mutations.
• Safe fixtures recognize route middleware, auth/bouncer evidence, tenant/object scope, validator/safe mapping, and Lucid transaction evidence.
• Route groups/resource routes and Lucid sinks are represented with stable fingerprints.
• Normal scans do not run Adonis or Node.

Test Plan

• Add framework/data-layer unit tests for routes, groups, middleware, controllers, HttpContext request APIs, validators, Bouncer/auth, Lucid model/query operations, and transactions.
• Add CLI fixtures for Adonis/Lucid safe and unsafe cases.
• Assert text, JSON, and SARIF output for route/source/sink/evidence/call path.
• Run cargo fmt --all -- --check, cargo clippy --locked --workspace --all-targets, and cargo test --locked --workspace.