Fix stale $query, whitelist captures+data, stream all body chunks

[troglodyne-bot]

What

Three bugs fixed in lib/TPSGI.pm, with a new test suite covering all three.

Why

Bug 1 — stale `$query` across keepalive requests

my $query = URL::Encode::url_params_mixed(...) if \$env->{QUERY_STRING} is undefined behavior in Perl when the condition is false. When QUERY_STRING is empty, \$query may retain its value from the previous subroutine call rather than resetting to undef. On a keepalive connection, subsequent requests with no query string would inherit the previous request's query params — causing unexpected 400s from the whitelist check, or worse, leaking params between routes.

Fixed: ternary form so \$query is always a fresh {}.

Bug 2 — whitelist missing captures and data keys

When a route defines parameters (strict validation mode), only keys in %\$parameters were whitelisted. Capture fields populated by the route regex (captures key) and static fields from route->{data} were not added to the allowed list. Any route that combined captures + parameters returned a spurious 400 Bad Request for every valid request.

Fixed: capture names and data keys are now explicitly pushed into @known_params before the whitelist sweep.

Bug 3 — stream_raw_psgi drops body after first chunk

print \$fh \$response->[2][0] wrote only the first element of the PSGI body arrayref. Multi-chunk responses (e.g. templates stitched together) silently lost everything after the first string.

Fixed: print \$fh \$_ for @{\$response->[2]}.

How

• All three are minimal, surgical changes — no refactoring.
• t/lib/TPSGITestStubs.pm: graceful stub loader for the 8 CPAN deps absent in the test environment (prefers real modules when loadable).
• t/lib/TestTPSGI.pm: minimal subclass that bypasses new() system checks and silences logging for unit tests.
• t/extract_query.t: 18 tests covering no-params passthrough, captures whitelisted, data keys whitelisted, mixed captures+data+params, invalid capture rejection, unknown param rejection, empty params hash.
• t/stream_raw_psgi.t: 6 tests using fork+pipe to capture raw HTTP output and verify single/multi/empty body handling.

Testing

PERLBASE=$HOME/perl5/lib/perl5
for f in t/*.t; do perl -I$PERLBASE -I$PERLBASE/x86_64-linux-gnu-thread-multi -Ilib -It/lib "$f"; done

All 24 tests pass.