feat(core): allow packages to declare global middleware in module.php

[michalbiarda]

Summary

• Adds globalMiddleware key to module.php — accepts class strings or ['class' => ..., 'priority' => N] entries
• GlobalMiddlewareResolver now collects, deduplicates (app > modules > vendor), and sorts by priority from module declarations only
• Removes DEFAULT_BUILT_INS constant and builtIns parameter — built-in middleware moved to their packages
• PageCacheMiddleware (priority 10), SessionMiddleware (priority 20), LayoutMiddleware (priority 30) now self-register in their module.php
• Package-level PackageStructureTest files verify each middleware declaration and priority

Test plan

• composer test passes (excluding pre-existing DevDownCommandTest flake)
• packages/core/tests/Unit/Module/GlobalMiddlewareResolverTest.php — all 14 resolver requirements covered
• packages/session/tests/PackageStructureTest.php — SessionMiddleware at priority 20
• packages/page-cache/tests/PackageStructureTest.php — PageCacheMiddleware at priority 10
• packages/layout/tests/PackageStructureTest.php — LayoutMiddleware at priority 30

Closes #79

🤖 Generated with Claude Code

[markshust]

Thanks for the PR, @michalbiarda — solid premise and clean implementation. The hardcoded GLOBAL_MIDDLEWARE constant in Application.php had no business naming downstream packages, and module-declared middleware aligns perfectly with Marko's true-modularity principle.

I pushed a refactor commit on top (force-with-lease, your three commits are preserved). The main change is dropping the priority field entirely:

Why: the project already has three ordering systems — plugins use sortOrder (lower first, default 0), observers use priority (higher first, default 0), and modules use sequence: { after, before }. The PR introduced a fourth: priority (lower first, default 100). That's the magic-numbers smell — 10/20/30 only make sense if you've memorized which slot each built-in occupies.

Instead: middleware order is just module load order. DependencyResolver already topologically sorts modules from composer require + sequence: { after, before }, so the resolver just walks them in order and dedupes by class. Source priority (app > modules > vendor) still applies to position when the same class is declared in multiple modules.

Built-in ordering is now self-documenting: marko/session declares sequence: { after: ['marko/page-cache'] }, marko/layout declares sequence: { after: ['marko/session'] }. Both are soft — only enforced when the named module is also installed.

Other small changes:

• globalMiddleware entries are now class-strings only (no array form). Non-string entries throw loudly.
• Tests reshaped to the new contract; 13 cases cover order preservation, dedup, source override, and validation.

Full suite green (5276 passing). Merging shortly — thanks again for the contribution!