Add basic-auth example: the simplest whole-site auth gate

[luthermonson]

Adds ephpm-middleware-basic-auth — an HTTP Basic (RFC 7617) whole-site gate, the simplest auth-gate teaching piece, alongside api-key.

What it teaches

• Parse Authorization: Basic <base64(user:pass)> (scheme token case-insensitive).
• Constant-time compare (subtle::ConstantTimeEq) against every configured credential — no early return, so neither the match position nor which usernames exist leaks via timing.
• 401 + WWW-Authenticate: Basic realm="…" challenge otherwise (browser login dialog).
• Optional forward_user_header to REWRITE the authenticated username into a request header for PHP (our SAPI does not populate PHP_AUTH_USER).

Reworked onto the #408 static gate

Since ePHPm #408 the request phase runs on the static-file path too (fail-closed, before the file is opened), so this gate denies unauthenticated static assets as well as PHP — the #395 fix. a_static_asset_is_challenged_before_it_is_read pins it: an unauthenticated request for /assets/app.js gets the 401 and the bytes are never served, while a valid credential lets the same asset through.

Scope

Relocated in spirit from the held ephpm/ephpm PR #387 and trimmed to example scope — no PBKDF2 hashing, KV-sourced per-site credentials, or verification cache. This teaches the pattern (like api-key); the compiled-in official module keeps the full feature set. Passwords are plaintext-in-config for clarity, with a doc note that production should store a slow hash.

Housekeeping

• Adds base64ct to the workspace deps (tiny, no_std, already used across the ePHPm middleware) to decode the Basic credential.
• README: lists four modules now, with basic-auth as the "start here" gate.

Verification

Local, against the pinned host ABI: cargo +nightly fmt --all -- --check, cargo clippy --workspace --all-targets -- -D warnings, cargo test -p ephpm-middleware-basic-auth (12 tests), and cargo build -p ephpm-middleware-basic-auth --release all clean.