feat: support bounded Elixir callbacks from JavaScript

[pepicrft]

What

Add per-execution Elixir callbacks callable synchronously from JavaScript through Javex.Host.call(name, argument), on both the in-process and isolated backends. HTTP stays in application callbacks; Javex adds no HTTP dependency or guest networking.

Javex.run(mod, input,
  callbacks: %{"http.request" => &MyApp.ScriptHTTP.request/2},
  callback_timeout: 1_000,
  max_callback_calls: 8
)

const response = Javex.Host.call("http.request", {path: "/status"});

Callbacks receive (argument, %{deadline: absolute_monotonic_ms}) and return {:ok, json_value} or {:error, %{"code" => ..., "message" => ...}}. Declared errors are catchable HostErrors; host crashes are sanitized. Call-count, request/result byte limits and callback deadlines terminate execution and cannot be bypassed with JS try/catch. Pending callbacks stop on cancellation, caller death or runtime shutdown, without blocking the runtime GenServer or occupying dirty CPU schedulers while waiting.

Provider compatibility

Bundle a custom Javy provider with its source, locked dependencies and build instructions. It preserves the synchronous Javy environment and adds a private, bounded Wasm hostcall bridge. Persisted dynamic modules compiled against the previous provider must be recompiled. Older static modules must be recompiled to use the new JS API. This is synchronous, not fetch or a Promise event loop.

The README includes an application-owned HTTP example with fixed destination, host-only credentials and bounded response reads. Elixir/HTTP allocations remain outside guest/process memory budgets; external effects cannot be rolled back.

Verification

Verified locally on Linux:

• JAVEX_BUILD=1 mix test --cover: 55 tests passed; 91.53% coverage.
• Real HTTP requests on both backends; dynamic/static modules, nested JSON, grant isolation, errors, byte/count boundaries, deadlines and cancellation.
• cargo test --manifest-path native/javex_nif/Cargo.toml --release --locked: 5 native tests passed.
• Compilation with warnings as errors, strict Credo, Clippy and Elixir/Rust formatting passed.
• Hex package contents and the README HTTP response-size boundary were checked.

macOS was not exercised locally. No release or deployment is included.