fix(middleware): expose Flusher, Hijacker and Unwrap on the response wrapper

[rennf93]

Closes #42

The statusObserver response wrapper now implements Unwrap, Flush and Hijack.

• Unwrap returns the underlying writer so http.NewResponseController reaches the deadline and full-duplex controls.
• Flush pins the implicit 200 and delegates to the real writer, so SSE and other streaming handlers reach the client as they write. In held mode (a CustomResponseModifier is configured) the modifier must see the whole response, so Flush is a no-op there and the response is sent at release.
• Hijack delegates to the underlying writer (http.ErrNotSupported when it cannot) and marks the connection as taken: the middleware then skips the response pass and the held-response release, so a hijacked connection is left alone.

Tests run against a real httptest server: an SSE handler whose first event must arrive before the handler returns, http.ResponseController.Flush, a raw hijack exchange with and without a modifier, and a held response that is still modified after a Flush.