Fix: store current route in per-request container

[loks0n]

Summary

• Http::$route was a plain instance property on a shared Http instance. Under Swoole coroutines, two concurrent requests could clobber each other's matched route.
• Moves route storage into the per-request DI container (already used via setRequestResource('route', ...)) and removes the redundant $this->route property.
• getRoute(), setRoute(), and match() now read/write the per-request container; http.route telemetry and the wildcard fallback follow the same path.

Situations this fixes

• http.route telemetry getting labeled with another in-flight request's path.
• Hooks calling $http->getRoute() (audit logs, permission checks, span naming) seeing another coroutine's route.
• Wildcard fallback assigning self::$wildcardRoute to the shared $this->route and masking a real match on a concurrent request.
• User code calling $http->setRoute(...) from a hook being overwritten by another coroutine.

Test plan

• vendor/bin/phpunit (pre-existing env failures in this checkout are unrelated — stale vendor utopia-php/di signature)
• Load-test Swoole coroutine server with mixed routes + wildcard; confirm http.route telemetry matches the actual route per request

🤖 Generated with Claude Code

[greptile-apps]

Greptile Summary

This PR fixes a Swoole coroutine race condition where two concurrent requests could clobber each other's matched route via the shared $this->route instance property. The fix moves route storage into the per-request DI container (the same mechanism already used for request, response, and error), clones the wildcard route per-request to prevent in-place mutation races, removes the now-redundant double-write in runInternal(), and bumps utopia-php/di to 0.3.2 which supports overwriting existing container entries.

Confidence Score: 4/5

Safe to merge; the concurrency fix is correct and the wildcard clone properly addresses the previous P1 concern. One minor asymmetry in match() remains.

All prior P1 findings (wildcard mutation, redundant double-write) are resolved in this revision. The one remaining finding is P2: match() with fresh=true does not update the container when Router::match() returns null, leaving a stale route if match() is called more than once per request. This does not affect the normal runInternal() flow and is unlikely to impact production, but a one-line fix would fully align the new implementation's semantics with the old one.

src/Http/Http.php — specifically the match() null-route path (lines 694–700)

Important Files Changed

Filename	Overview
src/Http/Http.php	Moves route storage from a shared instance property to the per-request DI container; clones wildcard route to prevent cross-coroutine mutation; removes the now-redundant double-write. One minor asymmetry: match() with fresh=true doesn't clear the container when Router::match() returns null.
composer.json	Loosens utopia-php/di constraint from 0.3.* to ^0.3.2 to pick up the overwrite-capable set() behaviour needed by this PR.
composer.lock	Lock file updated to pin utopia-php/di at 0.3.2 (07025d7); no other dependency changes.

_{Reviews (3): Last reviewed commit: "Bump utopia-php/di to ^0.3.2 for set() c..." | Re-trigger Greptile}