perf(api): skip inactive request interceptors

Why:
- The plugin host can exist without active request interceptors.
- The before-auth path still cloned large request bodies four times in that case.

What:
- Reuse the existing request interceptor capability detector before dispatch.
- Add pointer-reuse regression coverage and allocation benchmarks.

Validation:
- go test ./... -count=1
- go build -o /tmp/test-output ./cmd/server
- focused race test passed; the full handler race run still hits an existing stream-header race reproduced on origin/dev