feat: bind Doppel's own variables into every template

[lorem-dev]

Nine variables Doppel binds itself, a templated external_url, and snake_case
throughout the reference configuration.

What a template can see now

A template could see only what its own mock declared, so the things every mock
wants -- which proxy answered, which version, who called -- were extracted by hand
in each one, and two of them could not be extracted at all.

Variable	Is
proxy_name	The proxy that resolved. Empty when none did
mock_name	The mock answering. Empty for a forwarded request
doppel_version	The version serving the request
request_id	The id echoed in X-Request-ID, minted when the client sent none
method, path	The request line, without the query string
host	The Host the client asked for
peer_ip	The address the connection came from
real_ip	Who the request is said to be from

real_ip is the chain a proxy in front writes: X-Real-IP, then the leftmost
X-Forwarded-For entry -- the original client rather than the hop next to us, and
across field lines, because a chain split over several is legal and some proxies
emit it -- then the connection's own address. So it always has a value and no
template needs | default('').

peer_ip beside it is deliberate: one is a claim anybody can make and the other
is a fact, and a mock that decides something needs to know which it is reading.

Reserved, and why the advisory exists

They are bound after the operator's extractions, so a mock that extracts into
proxy_name finds Doppel's value rather than its own -- the alternative is a
template whose meaning depends on which mock rendered it. The extraction still
costs a header read, so startup names the mock and what it shadowed:

mock `m1` of proxy `alpha` extracts `proxy_name` into a name Doppel binds
itself; the system value wins, so the extraction is read and thrown away

The list of names lives in doppel-core: the binding is in doppel-render and
the validation is in core, and core is the crate both can see.

A templated external_url

server:
  external_url: "http://{{ host }}/"
  external_url: "https://{{ proxy_name }}.gw.example.com/"

A value containing {{ is a template rendered per request; anything else is
parsed as a url when the configuration is read, as before. The scheme has to be
literal, because a value that does not start with one cannot become a usable url
however it renders.

{{ host }} is opt-in for a reason, and the documentation says so in a warning:
Host arrives from the client, so a deployment that builds a redirect out of it
is choosing to let a caller decide where its own redirects point. A template that
fails to render, or renders to something that is not a url, means no rewriting for
that request rather than a failed one -- improving a Location is not worth a 500.

snake_case, and one extraction removed

Every variable name in main.example.yaml and the documentation is snake_case,
matching the system ones. An operator's own names are untouched; Jinja accepts
either.

The reference configuration also stopped extracting X-Request-ID into
request_id, which is now exactly the wasted work the advisory warns about.
mock4 keeps the strict-rendering lesson on X-Trace-Id, which is genuinely the
operator's, and renders proxy_name and doppel_version beside it.

Verification

make gate clean, make e2e clean (81 tests). Seventeen unit tests, three on the
templated address, and one end-to-end through the built binary over a real socket
-- the real_ip chain needs a peer to fall back to, and only a connection has one.

Mutation-checked twice: with nothing binding the system variables the end-to-end
test fails with undefined variable proxy_name, and ignoring X-Real-IP fails the
chain test.