RFE: Backend controller middleware, validation, and exception mapping #5993

Generated controllers support routing and binding, but unhandled controller exceptions are mapped to a generic 500 response. Applications lack a unified build-time controller-advice/exception-handler facility and reusable controller validation and interception contracts. Security filters already exist and should remain integrated with the request lifecycle.

Requested capability

• Add generated controller-level and global exception handlers with deterministic precedence and structured status/header/body responses.
• Provide reusable request/response interception with documented ordering relative to security, binding, controller execution, and error handling.
• Add a supported build-time validation contract for request fields and parameters, including nested validation and structured field errors.
• Document how to replace common Servlet/MVC extension points using native backend APIs without requiring a full Servlet container.

Acceptance criteria

• Controller-local handlers override global handlers according to documented rules, and unmapped errors retain safe generic responses.
• Validation rejects invalid input before application side effects and reports stable field paths.
• Interceptors execute completion cleanup on success, denial, binding failure, and handler failure.
• Authentication/CSRF enforcement cannot be accidentally bypassed by controller interception or error routing.

Current implementation

• maven/build-engine/src/main/java/com/codename1/maven/processors/RestControllerAnnotationProcessor.java
• docs/developer-guide/Backend-Web.asciidoc
• vm/backend/src/com/codename1/backend/HttpServer.java

Validate behavior on the JVM and locally on the packaged ParparVM backend where applicable. This request does not call for native-image or GraalVM CI jobs.