Many Bugs fixed and new methods

[papac]

• file() — the broken !is_uploaded_file(...) === UPLOAD_ERR_OK check (always false due to precedence) now correctly rejects non-uploaded files while preserving the array/multi-file path.
• locale() — the delimiter-less regex ('^([a-z]+)[-]?/i') that warned and never matched is now '/([a-z]+)[-]?/i', with null guards for a missing header.
• query() / post() — return type was array but returned scalars (guaranteed TypeError); now mixed with a $default argument matching get()'s contract.
• time() — read the non-existent $_SESSION['REQUEST_TIME']; now returns an int from $_SERVER['REQUEST_TIME'].
• old() — $fallback had no default, fataling on old('x'); now defaults to null (also fixed the fullback typo).
• hostname() / path() — guarded against undefined $_SERVER indices (CLI/tests) and fixed strpos truthiness with !== false.

Methods added:

isMethod(string) — match the request method.
input(key, default) — alias of get().
boolean(key, default) — coerce an input to bool (1/true/on/yes). bearerToken() — extract the token from an Authorization: Bearer … header.