Fix native route middleware during in-app navigation

[wojt-janowski]

Closes #252.

Problem

Route::native() returns a real Laravel route, so chained middleware runs when the screen is entered through the initial HTTP request. In-app navigation takes a different path: NativeRouter resolves the URI and mounts the component directly for push, replace, and hot-reload stack restoration.

That means route middleware such as auth, can, and custom guards can be silently skipped after the app starts. A protected native screen can therefore mount when reached from another native screen even though the same URL is guarded on cold start.

Fix

• Retain the Laravel route associated with each native route without changing the public native-route registry shape.
• Before in-app push, replace, or stack preload, clone and bind that route to a synthetic request for the destination URI.
• Resolve aliases, groups, exclusions, and priority through Laravel's real route middleware resolver.
• Scope the request, route binding, Route facade, and router request context while running Laravel's routing pipeline, then restore the long-lived context.
• Return blocked middleware responses unchanged, preserving redirect status, cookies, headers, and non-redirect responses.
• Skip protected historical entries during hot-reload stack restoration.
• Leave the cold-start HTTP path unchanged so middleware is not run twice.

The stored route is cloned before parameter binding, preventing navigation between values of the same route pattern from mutating earlier route state.

Verification

• php84 vendor/bin/pest — 800 passed, 2,799 assertions
• php84 vendor/bin/phpstan analyse --no-progress — no errors
• Pint and git diff --check pass
• iOS simulator reproduction:
  • released 4.0.1: in-app navigation mounted the protected component
  • fixed branch: the same navigation ran middleware and redirected before mount

Regression coverage includes allowed middleware, aliases and route parameters, auth/request/route context, push, replace, allowed and denied preload, exact redirect and 403 response preservation, exception reporting/rendering, and same-pattern parameter isolation.

[simonhamp]

Awesome!

[simonhamp]

Sorry for the turnaround on this. Superseded by #348