Replace core interfaces with templates, views and ASCII folding

[sassi67]

Summary

Applies the three findings from the dispatch micro-benchmark (branch perf/dispatch-microbenchmark, kept out of this branch as requested). Release, 2M iterations × 7 repetitions, generic path, min ns per call including per-request adapter construction:

variant	min ns
virtual interfaces + std::wstring/std::string copies (before this PR)	139.00
same interfaces, zero-copy + AsciiToLower	22.49
templates + zero-copy + AsciiToLower (this PR)	9.98
pre-refactor direct implementation (#8)	10.86

Copies cost ~116 ns, virtual dispatch ~4–13 ns — the allocations were the story, dispatch was the tiebreaker. The result is faster than the original direct implementation, because inline ASCII folding beats the _wcsnicmp CRT call.

1. Templates

IRequest/IResponse/IContext/IEventProvider become C++20 concepts, and ModuleHandler::OnBeginRequest becomes a template constrained by them. Files renamed to match (IRequest.h → Request.h, …) — the I prefix means "abstract base" in this codebase and would mislead on a concept. IModule is deleted: with compile-time binding there is nothing left to abstract.

Adapters and mocks now satisfy the contracts by shape alone, each confirmed by a static_assert — with no base class to inherit from, that assert is the only place a broken contract surfaces, so please keep them.

2. std::string_view / wstring_view

RawHttpRequest::absPath is a non-owning wstring_view over the buffer IIS owns, and IISResponse forwards .data() straight to IIS instead of materializing std::strings. Both hot-path allocations are gone. core::Response documents the null-termination precondition this relies on; every call site passes views over string literals.

3. AsciiToLower

Replaces std::towlower, which consults the active C locale and can fold the same URL differently depending on process configuration — flagged as a correctness problem in the security review (PR #14), and a per-character CRT call besides.

For reviewers

• Only OnBeginRequest lives in a header, and that is a language constraint, not a preference. A template must be visible where it is instantiated, and it is instantiated with the IIS adapter types — which core must not include without inverting the dependency direction. Everything else (the EndsWithForbidden algorithm, all four adapters) stays in its .cpp, preserving the one-.h/.cpp-pair-per-class convention.
• The injection seam moved from runtime to compile time. IISRequestLevelModule now holds const core::ModuleHandler* instead of core::IModule*. Constructor injection and factory ownership are unchanged in shape, but handlers can no longer be swapped at runtime — that is the price of the dispatch win, and it is a deliberate trade against issue Implement OnBeginRequest unit testing #11's original runtime seam.
• Because the adapters and EndsWithForbidden sit behind translation-unit boundaries, those calls stay real calls unless /GL+/LTCG is enabled. The two dominant costs (allocations, vtable) are gone either way; enabling LTCG would recover the remaining few ns if wanted.
• The try/catch boundary in OnBeginRequest is retained. The adapters no longer allocate so a throw is now implausible, but the no-throw contract with IIS applies to whatever gets added later.

Test plan

• Clean rebuild from a wiped _build/, Debug and Release: zero warnings, zero errors
• 9 tests pass (up from 2): added case-insensitive matching, suffix-vs-prefix semantics, short URL, and four AsciiToLower tests including that it leaves U+0130 untouched
• DLL still exports exactly one symbol, RegisterModule, and is still CF instrumented
• CLAUDE.md updated with the architecture and the benchmark numbers as rationale, so this is not "simplified" back into virtual interfaces

🤖 Generated with Claude Code