[v4.x] fix: group middleware not applied on dynamic routes (#327 backport)

[mychidarko]

Backport of the #327 fix from v5.x (c076298, "fix: patch up middleware not running on dynamic routes within groups") to v4.x.

Problem

Fixes #327 for Leaf v4 users (also reported as leafsphp/auth#32 and #316).

Group / in-route middleware on a dynamic route (e.g. auth.required on /clients/{id} inside app()->group()) is skipped whenever any catch-all middleware is registered (app()->use(), e.g. CORS):

/clients     -> GLOBAL , AUTH , index
/clients/42  -> GLOBAL , show:42      <- auth skipped

Router::handle() filtered the matched middleware with pattern === $uri || pattern === '/.*' || …. A dynamic pattern never string-equals the URI, and the global /.* entry keeps the filtered list non-empty, so the "fall back to everything" branch never kicks in. Without a global middleware the fallback hides the bug, which is why it looked intermittent.

Fix

Same change as v5.x: drop the filter and run every middleware findRoute() matched (it already does regex matching against the URI).

Tests

Ported the three regression tests from v5.x tests/middleware.test.php (#316 + #327):

• group middleware runs for dynamic routes inside the group
• in-route middleware runs for dynamic routes inside a group
• dynamic group middleware still runs when a catch-all middleware exists

Router::reset() only exists on v5.x, so the tests use a small resetRouterState() helper (reflection, restores the router's static defaults) instead. No change to src/ beyond the fix.

Results (PHP 8.3, deps pinned to the v4-era majors locally):

• with the fix: 11 passed, 0 failed (same risky count as before)
• without the fix: dynamic group middleware still runs when a catch-all middleware exists fails, i.e. the test catches the bug

Heads-up on CI

composer.json on this branch requires leafs/http, leafs/anchor and leafs/exception as *, so a fresh install now resolves the v5 packages (leafs/exception 5.x has no Leaf\Exception\Run) and the whole suite errors before reaching these tests. Locally I tested with composer update --with 'leafs/exception:<5' --with 'leafs/http:<5' --with 'leafs/anchor:<5' …. If CI is red here, that is why. Pinning those constraints is a separate change; happy to open it if you want it.