feat(cpp-boost-beast-server): add HTTP/1.1 server generator

[bold84]

cpp-boost-beast-server: new OpenAPI HTTP/1.1 server generator (C++17)

Builds directly on current master, which includes the client OAS 3.1 work from #24760 (squash-merged as c27ee27572b). The diff contains only the server additions — 13 commits, 103 files (+16,435/−1,447): ~7,200 lines of generator source + tests, ~9,200 lines of committed sample/docs (the usual shape for a new-generator PR in this repo).

Adds a new cpp-boost-beast-server generator that produces a C++17 Boost.Beast HTTP/1.1 server from OpenAPI documents (OAS 3.0 and 3.1). It shares the model pipeline with the client generator (refactored into CppBoostBeastModelCodegen without changing client output) and reuses the OAS 3.1 schema-validation runtime for request-body validation.

Scope

Generator

• New cpp-boost-beast-server generator (beta) with typed request/responder contracts per operation (GetPetByIdRequest, GetPetByIdResponder), OAS parameter deserialization (path/query/header/cookie, incl. simple/label/matrix/form/spaceDelimited/pipeDelimited/deepObject-string-map styles), and a security seam (Authorizer, deny-by-default).
• Shares the model pipeline with the client via CppBoostBeastModelCodegen; client output stays byte-identical.
• OAS 3.1 request bodies are validated with the same generated schema-evaluator runtime the client uses; OAS 3.0 continues through the normal path.
• Hard-rejects at generation time only what cannot route deterministically: ambiguous path templates (/a/{x}/c vs /a/{y}/c) and ranged status codes (2XX). Fails closed with precise diagnostics.
• Degrades with a warning everything else the runtime cannot serve faithfully — chosen so real-world corpora (canonical petstore, the OpenAI spec) still generate compiling code, per the repository harness contract:
  • request media types are filtered to JSON (a mixed body accepts JSON and answers 415 to the rest; a JSON-less body loses its typed body);
  • response media types serialize as JSON;
  • security scheme types with no runtime credential extractor (oauth2/openIdConnect/mutualTLS) deny all requests with 401 rather than being silently unauthenticated;
  • parameters the codecs cannot decode from a raw string are dropped from the handler (content-style, form fields, non-deepObject object queries, non-scalar array items, cookie containers, unsupported styles, heterogeneous enums, enum-class dataTypes);
  • request bodies whose model resolves to std::variant (composition unions, including models aliased to one) get no typed body, since decode-side union matching needs the schema matcher the request path does not run.
• Recovery: a multipart+JSON body whose JSON member $refs a generated model types the handler body exactly (its #include is appended via toModelImport); a body model colliding with the generated request struct is namespace-qualified.
• RFC 9457 application/problem+json errors throughout, with WWW-Authenticate challenges for http-scheme security.

Runtime

• Boost 1.81+ floor; Boost.URL as a compiled library; strand-based HttpServer with keep-alive, request version/keep-alive mirroring, 413 body-limit handling that closes the connection, and atomic single-completion guard on responders.
• Router ranks literal path segments over parameters, so /pets/bulk wins over an earlier-registered /pets/{petId}.
• Deferred handler completions are supported: the response-write deadline is re-armed per response, so a worker-thread reply arriving after the read timeout still reaches the client.
• Anonymous security alternatives (security: [] or an empty OR-group) bypass the authorization gate with no authorizer required.
• Generated C++ builds clean under -Wall.

Sample, docs, CI

• samples/server/petstore/cpp-boost-beast-server (byte-deterministic regeneration).
• docs/generators/cpp-boost-beast-server.md and generator index entry.
• .github/workflows/samples-cpp-boost-beast-server.yaml: Ubuntu / macOS / Windows build matrix with per-OS Boost installs (Windows: vcpkg boost-asio/boost-beast/boost-json/boost-url/boost-multiprecision).

Verification

• Real-world corpus: the full OpenAI OpenAPI document (~1 MB, OAS 3.1, 4,871 model files, 74 API files) generates, compiles with -Wall -Wextra at 0 errors / 0 warnings, and links — exercising the degrade policy (form fields, variant-alias and mixed bodies, enum-class params) and the recovery path (recovered JSON-member bodies with appended includes) at scale.
• Repository contract: AllGeneratorsTest passes, i.e. this generator accepts src/test/resources/3_0/petstore.yaml (the spec that mixes XML/form/multipart payloads and an oauth2 scheme) exactly as the harness requires — degrade, not reject.
• Focused Boost.Beast selection on this head: 184 tests, 0 failures, 5 skips (generated-C++ runtime tests skip when Boost headers are unavailable on the runner).
• Real-world corpus: the full OpenAI OpenAPI document (~1 MB, OAS 3.1, 4,871 model files, 74 API files) generates, compiles with the generated project's -Wall build at 0 errors / 0 warnings, and links — exercising the degrade policy (form fields, variant-alias and mixed bodies, enum-class params) and the recovery path (recovered JSON-member bodies with appended includes) at scale.
• Petstore sample builds warning-free and smoke-tested (501 stubs, 400 bad path param, 404 unknown route).
• Sample regeneration is byte-deterministic; client sample unchanged by the shared-pipeline refactor.

Notes

• Kept as draft pending maintainer bandwidth; the feat(cpp-boost-beast): add OAS 3.1 schema validation #24760 dependency is resolved (merged), so the diff is final and review-ready.
• The generator is marked beta; the runtime is designed for embedding (all generated sources in the project), not yet published as a standalone library.