requestContextMiddleware DI missing on nested directAccess ops

New Issue Checklist

• Report security issues confidentially.
• Any contribution is under this license.
• Before posting search existing issues.

Issue Description

requestContextMiddleware (added in #8480) is only mounted on the Express stack (REST + GraphQL). With directAccess: true (default), nested Parse SDK save / destroy calls from Cloud Code go through ParseServerRESTController → Config.get(), and never pass through Express.

Anything injected onto req.config by the middleware (custom controllers / DI) is therefore missing on hooks that run for those nested ops, even though the outer HTTP request had the DI applied.

This is separate from #10291 (context object leakage); this is about request-scoped config DI never being applied on the directAccess path.

Steps to reproduce

1. Configure Parse Server with directAccess: true and:

requestContextMiddleware: (req, res, next) => {
  req.config.aCustomController = 'aCustomController';
  next();
}

2. Register:

Parse.Cloud.beforeSave('Child', request => {
  // expects request.config.aCustomController
});
Parse.Cloud.afterSave('Parent', async () => {
  await new Parse.Object('Child').save(null, { useMasterKey: true });
});

3. Save a Parent object (nested Child.save uses ParseServerRESTController).

Actual Outcome

request.config.aCustomController is undefined in the nested Child beforeSave.

Expected Outcome

Same DI as HTTP: request.config.aCustomController === 'aCustomController', matching the intent of #8480 (“inject providers available in each hook”).

Environment

Server

• Parse Server version: 9.10.1-alpha.3 (also affects prior releases with requestContextMiddleware + directAccess)
• Operating system: macOS / Linux
• Local or remote host: local

Database

• System: MongoDB
• Database version: 8.0.4
• Local or remote host: local

Client

• SDK: JavaScript (Cloud Code / Node)
• SDK version: bundled with Parse Server

Logs

N/A — assertion failure in Cloud hook when reading injected config property.

Start at requestContextMiddleware, ParseServerRESTController, and Config.get() to trace how directAccess nested saves and destroys reach Cloud hooks without the Express stack. Reproduce the Parent/Child save scenario with the shown injected controller, then verify that the nested Child beforeSave request receives the same config value as the outer HTTP request.