Extensible Layer 7 (HTTP) firewall prototype with pluggable rules (path, rate limit, captcha challenge) and optional telemetry stats.