fix(protocol)!: Correct Gemini handling and prepare Windmark 0.9.0

[Fuwn]

Windmark's default TLS preset disabled TLS 1.3, response metadata could misrepresent the payload, and equivalent percent-encoded paths could fail to match registered routes. This PR corrects those behaviours and prepares Windmark 0.9.0. Rossweisse remains at 0.0.4.

Changes

• Enable TLS 1.3 alongside TLS 1.2, and remove obsolete protocols and cipher suites from the default acceptor. Custom acceptors remain supported.
• Validate redirect URI grammar before sending the target, and reject requests when URL parsing introduces userinfo.
• Resolve MIME parameters consistently, reject wildcards and duplicate parameters, and validate Gemtext language tags for all response types.
• Keep string responses in UTF-8 and honour explicit charset and language settings on byte responses without transcoding their payloads.
• Match equivalent percent escapes and escaped unreserved characters while preserving original captures, escaped slashes, and optional case-insensitive lookup.
• Correct the input and callback examples to decode prompt input and prevent exposure of sensitive queries.

Compatibility

Clients relying on obsolete cipher suites may no longer connect to the default acceptor. String responses labelled with a different charset now result in a temporary failure; applications serving a different encoding should use pre-encoded byte responses with matching metadata.

Explicit response setters take precedence over embedded MIME parameters. Router defaults fill in missing parameters for string responses. Invalid metadata now results in a temporary failure rather than a malformed success response.

URI-equivalent route registrations now conflict. Applications registering both /~user and /%7Euser, for example, must retain only one registration. Captured values retain their original spelling.