Extend defhandler with :path/:method/:csrf, migrate 12 ref endpoints to SX

defhandler now supports keyword options for public route registration:
  (defhandler name :path "/..." :method :post :csrf false (&key) body)

Infrastructure: forms.sx parses options, HandlerDef stores path/method/csrf,
register_route_handlers() mounts path-based handlers as app routes.

New IO primitives (boundary.sx "Web interop" section): now, sleep,
request-form, request-json, request-header, request-content-type.

First migration: 12 reference API endpoints from Python f-string SX
to declarative .sx handlers in sx/sx/handlers/ref-api.sx.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

shared/sx/ref/boundary.sx

@@ -126,6 +126,57 @@
         "list" "dict" "sx-source"))
 
 
+;; --------------------------------------------------------------------------
+;; Web interop — reading non-SX request formats
+;;
+;; SX's native wire format is SX (text/sx). These primitives bridge to
+;; legacy web formats: HTML form encoding, JSON bodies, HTTP headers.
+;; They're useful for interop but not fundamental to SX-to-SX communication.
+;; --------------------------------------------------------------------------
+
+(define-io-primitive "now"
+  :params (&rest format)
+  :returns "string"
+  :async true
+  :doc "Current timestamp. Optional format string (strftime). Default ISO 8601."
+  :context :request)
+
+(define-io-primitive "sleep"
+  :params (ms)
+  :returns "nil"
+  :async true
+  :doc "Pause execution for ms milliseconds. For demos and testing."
+  :context :request)
+
+(define-io-primitive "request-form"
+  :params (name &rest default)
+  :returns "any"
+  :async true
+  :doc "Read a form field from a POST/PUT/PATCH request body."
+  :context :request)
+
+(define-io-primitive "request-json"
+  :params ()
+  :returns "dict?"
+  :async true
+  :doc "Read JSON body from the current request, or nil if not JSON."
+  :context :request)
+
+(define-io-primitive "request-header"
+  :params (name &rest default)
+  :returns "string?"
+  :async true
+  :doc "Read a request header value by name."
+  :context :request)
+
+(define-io-primitive "request-content-type"
+  :params ()
+  :returns "string?"
+  :async true
+  :doc "Content-Type of the current request."
+  :context :request)
+
+
 ;; --------------------------------------------------------------------------
 ;; Tier 3: Signal primitives — reactive state for islands
 ;;