Give server() consumers the onRequest hook the docs promise (#86)

* Regression tests for an onRequest hook on server()

* Compose the application's onRequest hook into server() past bind

* Document the server's onRequest hook and record the composition decision

* Pin that a re-bind and a pre-bind unbind never reach the hook, and that a non-function hook is refused at startup

* Keep every bind and all pre-bind traffic out of the application's hook

* Make the hook's published promises exact, and record the src layout deferral

* Trim the record to what the tests do not already forbid

* Pin that nothing answers a request whose hook failed

* Answer nothing for a request whose hook failed, on both surfaces alike

* State the hook's failure policy as it now behaves

* Name the request a failed handler left unanswered, and say what a wedged hook reports

src/session-options.ts

@@ -81,7 +81,7 @@ export type CloseOptions = { signal?: AbortSignal | undefined };
  * built-in handling is skipped — this is how the server owns bind without the session also
  * replying "invalid command".
  */
-export type OnRequest = (session: Session, pduObj: PduObject) => Promise<boolean>;
+export type OnRequest = (session: Session, pduObj: PduObject) => Promise<boolean> | boolean;
 
 /**
  * How to come back after an unexpected disconnect. The session owns the retry loop; the caller