Fix response decoding, framing, and OPTIONS replay

[mandatoryprogrammer]

Chrome response capture can corrupt non-ASCII bytes and forward compressed or chunked framing for a decoded body. Ordinary OPTIONS requests can also be mistaken for preflights and swallowed until timeout. This change returns the captured bytes with consistent downstream headers and forwards ordinary OPTIONS requests to the server.

• Share direct base64/UTF-8 decoding and response-header normalization across navigation and synthetic capture. Remove upstream compression/transfer framing and connection-specific fields, preserve repeated headers, and emit one correct length where permitted.
• Finalize framing after AFTER_REQUEST_HOOK: normalize the final body to bytes, discard stale length/transfer/trailer headers, and recalculate the length. Reapply bodyless rules to the final status, including hook changes; frame generated fallback responses the same way.
• Keep the bundled after-request hook compatible with repeated metadata values by reading a string view without mutating response headers or combining stored Set-Cookie fields.
• Handle HEAD, empty statuses, and redirects without requesting unavailable CDP bodies. Derive HTTP/1 persistence from the downstream request; keep HTTP/2 free of connection-specific headers.
• Identify preflights by Origin and Access-Control-Request-Method, omit the optional allow-headers field when unneeded, and fail promptly on Chrome response-stage network errors.

Validation used existing dependencies, Chrome 152.0.7977.64, a disposable policy-configured profile, and ordinary local HTTP fixtures through the actual proxy and request engine. All 38 checks passed: navigation/fetch across Unicode, gzip/Brotli/deflate, header casing, chunked bodies, redirects, empty statuses, partial responses and cookies; binary fetch, HEAD, same/cross-origin OPTIONS, network failure, timeout expiry and recovery. Normal responses reused the downstream connection. Repeated Set-Cookie preservation was checked at the formatter boundary because this Chrome build omits those fields from the observed Fetch events. JavaScript syntax and git diff whitespace checks passed.

Post-hook validation passed 36 additional local wire checks using asynchronous hooks over HTTP/1.1 and TLS HTTP/2: growing/shrinking Unicode bodies, binary and typed-array bodies, empty bodies, supported header containers, bodyless status changes, repeated cookies, and fallback responses. All 36 normal Chrome navigation/fetch checks passed again after this change; the two timeout cases were verified in the earlier run.

Repeated-header compatibility passed eight focused checks through the real formatter and bundled hook, plus all 36 HTTP/1.1 and HTTP/2 wire checks with repeated Server values processed by that hook. These checks preserve separate cookies and use local fixtures only.

Details are in _readme/internal-notes.md. No dependency, Chrome launch configuration, or main README changes. Refs #49.