[kolkov]

Follow-up to #32.

• README: the recommended middleware order now puts CORS and Secure before Timeout. Middleware registered inside Timeout runs with the handler, and its response headers are discarded with the handler's when the 503 is written — CORS and Secure headers would be lost exactly where a browser needs to read the error.
• README: the middleware example count is 9, matching the new middleware.
• Adds .github/dependabot.yml for GitHub Actions, weekly and grouped, with the type: dependencies label so Dependabot does not create bare labels of its own.

Docs and CI config only; no code or behavior change. CI should be the same 12 checks.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!