TypeScript: implement Koa route, middleware, router, and context support

[bjcorder]

Parent

Part of #89.

Context

Koa is a major middleware-oriented Node framework. Route support commonly comes through @koa/router or koa-router, and request data flows through ctx, middleware, body parsers, params, query, cookies, headers, and state.

Reference: https://koajs.com/

Scope

• Discover Koa apps, routers, router.get/post/put/patch/delete, router.use, prefixes, nested routers, middleware chains, and mounted routes where statically visible.
• Extract route method, path, handler, route params, middleware, request sources, and spans.
• Extract request-controlled sources from ctx.params, ctx.query, ctx.request.body, ctx.request.files, ctx.headers, ctx.cookies, ctx.state, and body parser outputs.
• Normalize auth/session/current-user middleware evidence, tenant helpers, authorization middleware, and configured helpers.
• Preserve middleware order and prefix inheritance deterministically.
• Integrate with service tracing and data-layer sinks.

Acceptance Criteria

• Koa unsafe fixtures emit expected findings for unscoped route-param/body flows.
• Safe fixtures recognize auth middleware, ctx.state current user/tenant evidence, tenant/object scope, and safe mapping.
• Router prefixes and nested routers are represented correctly.
• Ambiguous middleware/context mutations lower confidence rather than producing speculative findings.

Test Plan

• Add framework unit tests for Koa apps, routers, prefixes, middleware, request APIs, and context state.
• Add CLI fixtures for Koa safe and unsafe cases.
• Assert JSON source IDs and call path frames.
• Run cargo fmt --all -- --check, cargo clippy --locked --workspace --all-targets, and cargo test --locked --workspace.