chore: release server 0.8.46, cli 0.10.36

[vivek7405]

Release the accumulated unreleased work on @webjsdev/server and @webjsdev/cli. Merging this adds the changelog/**.md files to main, which triggers release.yml to npm publish both packages and cut GitHub Releases.

@webjsdev/server 0.8.45 -> 0.8.46 (patch)

• fix (dogfood: route() adapter ignores an action's declared export const middleware #876): route() now accepts the action's module namespace and auto-applies its declared middleware + validate, so a guard declared once protects the RPC and REST boundaries alike (from fix: dogfood triage (route() middleware, scaffold typecheck, scaffold a11y) #879).

@webjsdev/cli 0.10.35 -> 0.10.36 (patch)

• fix (dogfood: fresh saas scaffold fails webjs typecheck #877, dogfood: fresh saas scaffold has axe a11y violations (missing h1, color-contrast) #878): fresh saas scaffold passes webjs typecheck and returns zero axe violations out of the box (from fix: dogfood triage (route() middleware, scaffold typecheck, scaffold a11y) #879).
• feat (feat: close coverage-gate deferred gaps with real scaffold demos #870): close coverage-gate deferred gaps with real scaffold demos.
• feat (feat: add tier-2 scaffold teaching-coverage gate for core exports #861): tier-2 scaffold teaching-coverage gate for core exports.
• feat (feat: add boundaries gallery demo + harden scaffold-sync skill (#848 follow-up) #854): boundaries gallery demo + hardened scaffold-sync skill.

Not bumped (checked all published packages)

• core, mcp, intellisense: only carry the cosmetic WebJs brand-casing prose change (feat: enforce WebJs brand casing with one simple prose rule + one-time fix #855) and a docs commit (docs: capitalize WebJs at sentence starts in prose #851); no behaviour change, so they ride to the next functional bump.
• ui: the one unreleased commit (fix: match Webjs UI/blog logo to webjs.dev + add Preview/Code toggle to component docs #862) touched only packages/ui/packages/website (the nested website), not the published @webjsdev/ui surface.

Notes

• Both bumps are patch and stay within the existing ^0.8.0 / ^0.10.0 dependent caret ranges, so no dependent range edits.
• package-lock.json resynced (it was stale on main). The diff is three workspace version lines: server -> 0.8.46 and cli -> 0.10.36 (the bumps), plus core 0.7.30 -> 0.7.32 correcting the lockfile to core's already-current package.json (core itself is NOT re-released; only the server and cli changelog files trigger a publish).
• The lockstep wrappers (create-webjs, webjsdev) are intentionally NOT bumped here; release.yml owns them.

Changelogs: changelog/server/0.8.46.md, changelog/cli/0.10.36.md.

[vivek7405]

Release checks out. Both bumps are patch and stay inside the ^0.8.0 / ^0.10.0 dependent ranges, the changelogs match the real changes and their hashes resolve, and the not-bumped packages (core/mcp/intellisense only cosmetic casing + docs, ui only the nested website) genuinely carry nothing releasable. One thing I confirmed and noted in the body: the lockfile resync also corrects a stale core entry (0.7.30 to 0.7.32) to match core's already-current package.json, so core is not re-released, only server and cli publish. Clean.

[vivek7405]

Confirmed the publish path: release.yml keys on added changelog/**.md files (--diff-filter=A), and the diff adds exactly two (server 0.8.46, cli 0.10.36), so only those publish. Frontmatter versions and counts match the bumped package.json files. Ready to merge.