Add Inertia v3 DevTools protocol support to inertia-sails

[DominusKelvin]

Summary

Implement the Inertia v3 DevTools server protocol in inertia-sails and update all Boring Stack templates to use compatible Inertia client adapters.

This should follow the protocol and behavioral guarantees of inertia-laravel v3.2+, while using Sails-native integration points: the hook lifecycle, AsyncLocalStorage request context, Action2 route metadata, Express response handling, and .tmp runtime storage.

References:

• https://inertiajs.com/docs/v3/advanced/devtools
• https://inertiajs.com/docs/v3/advanced/devtools-protocol
• https://github.com/inertiajs/inertia-laravel/tree/3.x/src/DevTools
• https://github.com/inertiajs/inertia-devtools

Protocol requirements

• Add X-Inertia-Devtools-Id to every recorded response.

• Add X-Inertia-Devtools-Parent-Out for visit correlation.

• On initial Inertia HTML responses, inject the exact discovery payload:

  <script data-inertia-devtools-id type="application/json">"<id>"</script>

• Consume the client correlation headers for tab, visit, parent, deferred, and poll requests.

• Implement GET /_inertia/devtools/entries/:id using the documented backend-agnostic entry shape.

• Implement the optional entries index endpoint for parity and diagnostics.

• Derive request types in protocol order: precognition, initial, HTTP, deferred, poll, partial, prefetch, navigate.

• Record required __meta, HTTP, props, route, render-source, and component-path information.

Sails-native design

• Store a per-request recorder in the existing AsyncLocalStorage context.
• Start recording from the existing dynamic Inertia middleware, excluding static assets and DevTools routes.
• Integrate collection into share(), page construction, prop resolution, and final rendering.
• Finalize from the response lifecycle without delaying or breaking the application response.
• Resolve Action2 source information from req.options.action, req.route.path, and sails.config.paths.controllers.
• Resolve component paths from configurable page roots and extensions, with traversal protection.
• Keep all recorder instrumentation effectively inactive when DevTools is disabled.
• Treat recorder/source/storage failures as non-fatal.

Prop inspection

Support classification and metadata for:

• standard/always props
• deferred props and groups
• optional props
• merge, append/prepend, deep merge, and matchOn
• scroll props
• once props
• reset props
• successfully resolved and rescued values

A deferred prop should be classified as defer only for an actual DevTools deferred request; a manual partial reload should classify it as a regular evaluated prop.

Storage and security

• Default to enabled only in the Sails development environment.
• Outside development, fail closed unless explicitly enabled and an application-provided authorize(req) callback approves access.
• Store atomic per-entry JSON under .tmp/inertia-devtools by default.
• Add configurable TTL, pruning interval, and per-tab entry limit.
• Redact sensitive headers, URL/query values, body keys, nested prop values, and the final stored payload.
• Never persist raw uploaded files.
• Omit binary, streamed, multipart, unserializable, and oversized bodies safely.
• Add a circuit breaker for repeated storage failures.

Client/template updates

• Raise all React, Vue, and Svelte Inertia client adapters in the five templates to at least v3.6.
• Regenerate lockfiles.
• Confirm the Rsbuild import.meta.env.DEV path enables client-side DevTools interceptors; pass dev explicitly only if needed.
• Document configuration, authorization, storage, redaction, and extension setup.

Verification

Add coverage for:

• discovery headers and initial HTML tag injection
• JSON, HTML, redirect, error, and plain HTTP responses
• all request types and parent/tab/batch correlation
• all prop classifications and values
• Action2 route/action/render/component source locations
• request/response headers and body capture
• redaction, uploads, binary/streamed/oversized responses
• atomic persistence, corrupt entries, TTL, pruning, limits, and circuit breaking
• development authorization and production fail-closed behavior
• exclusions and no-op behavior when disabled
• the guarantee that DevTools failures never break user responses

Definition of done

• The official Inertia DevTools extension discovers initial and subsequent visits from a generated Boring Stack application.
• Entries conform to the published protocol and are retrievable immediately by ID.
• All adapter and template tests pass.
• Existing Inertia behavior remains unchanged when DevTools is disabled.