✨ feat(server): api.v2_enabled hot-reload via middleware gate (ADR-0023 Phase 4)

Closes ADR-0023 — all 4 phases now shipped. Final field: api.v2_enabled.

Approach: always-register-with-middleware-gate.

- /api/v2/* routes are now registered UNCONDITIONALLY at startup
- new Server.v2EnabledGate middleware reads the live config on every
  request and returns 404 + {"error":"not_found","message":"v2 API is
  currently disabled"} when api.v2_enabled is false
- the existing Config.WatchAndApply hot-reload pipeline already keeps
  the config struct fresh — no extra plumbing needed
- flag flip takes effect on the NEXT request (not in-flight ones)
- no router rebuild, no restart

Tested via 3 unit tests in pkg/server/v2_gate_test.go:
- blocked-when-disabled: 404 + correct error message + JSON content-type
- passes-when-enabled: NOT 404, gate message ABSENT (handler executed)
- hot-reload-mid-life: same Server, same router, config flipped between
  two requests → 404 then 200, proves the gate reads live config

Race detector clean. Full BDD suite green. ADR-0023 status promoted to
"Implemented" (no more parenthetical phase tracking).

The original "deferred" rationale in ADR-0023 listed router refactor as
the cost. Turns out the cost was minimal: ~25 lines of middleware + 3
tests + an `if` block deletion.

adr/README.md

@@ -26,7 +26,7 @@ This directory contains the Architecture Decision Records (ADRs) for the dance-l
 | [0020](0020-docker-build-strategy.md) | Docker Build Strategy: Traditional vs Buildx | Accepted |
 | [0021](0021-jwt-secret-retention-policy.md) | JWT Secret Retention Policy | Implemented |
 | [0022](0022-rate-limiting-cache-strategy.md) | Rate Limiting and Cache Strategy | Implemented (Phase 1) |
-| [0023](0023-config-hot-reloading.md) | Config Hot Reloading Strategy | Implemented (Phase 1+2+3) |
+| [0023](0023-config-hot-reloading.md) | Config Hot Reloading Strategy | Implemented |
 | [0024](0024-bdd-test-organization-and-isolation.md) | BDD Test Organization and Isolation Strategy | Implemented |
 | [0025](0025-bdd-scenario-isolation-strategies.md) | BDD Scenario Isolation Strategies | Implemented |
 | [0026](0026-composite-info-endpoint.md) | Composite Info Endpoint vs Separate Calls | Implemented |