test(public-api): symmetric assertion against __all__

test_expected_exports used `missing = expected - set(__all__)` so it
caught symbols missing from __all__ but not the reverse — symbols added
to __all__ that aren't in the expected set slipped through (the companion
test_all_exports_resolve catches symbols in __all__ that don't exist at
all; the gap was real symbols accidentally added to __all__).

Switch to `assert expected == set(__all__)` with a multi-line message
that names both directions, so future test failures pinpoint which side
drifted.

Closes audit Nit finding (test_public_api.py:69-71) from
planning/audit/2026-06-07-deep-audit.md.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: lesnik512

tests/test_public_api.py

@@ -67,5 +67,7 @@ def test_expected_exports() -> None:
         "before_request",
         "on_error",
     }
-    missing = expected - set(httpware.__all__)
-    assert not missing, f"expected exports missing from __all__: {missing}"
+    actual = set(httpware.__all__)
+    assert expected == actual, (
+        f"__all__ mismatch:\n  missing from __all__: {expected - actual}\n  unexpected in __all__: {actual - expected}"
+    )