Extract shared middleware conformance test suite

[SimplyLiz]

Problem

The four middleware packages (Express, Fastify, Hono, Koa) each have their own test suites that test the same behaviors independently. ~85% of test code is functionally identical across all four packages (~332 tests total, ~280 duplicated).

Shared behaviors tested in every package:

• Middleware: null profile when no cookie, attach classified profile, custom cookie name, fallback profiles, header classification, Accept-CH header, onEvent callbacks, storage error handling
• Endpoint: store profile + set cookie, secure cookie flag, reuse session token, 400 on invalid payload, bot rejection, onEvent callbacks
• Inject: inject before </head>, fallback to </body>, skip non-HTML, nonce support
• Integration: full probe → classify → attach flow

Framework-specific tests are minimal (Koa's ctx.type = 'html' shorthand, Hono's malformed JSON handling).

Proposal

Extract a shared test suite factory that takes a framework-specific adapter:

// packages/middleware-test-suite/ or similar
export function createMiddlewareTests(adapter: {
  sendProbe: (signals, cookie?) => Promise<Response>;
  getPage: (cookie?) => Promise<{ profile, headers, body }>;
  getHtml: (cookie?) => Promise<{ body, headers }>;
}) {
  it('returns null profile when no cookie', ...);
  it('attaches classified profile from storage', ...);
  // ~70 shared test cases
}

Each middleware package provides the thin adapter and calls the factory. Framework-specific edge cases stay in their own test files.

Benefits

• Bug fix or new feature → one test update instead of four
• Adding a new middleware package (e.g. middleware-h3 for Nitro/Nuxt) → implement adapter methods, get 70+ tests for free
• Single source of truth for what "correct middleware behavior" means

Priority

Low. This is a refactoring task, not a blocker. Best time to do it is when adding a fifth middleware adapter.