fix(routes): deduplicate route nodes - eliminate ghost nodes and real duplicates

Route extraction produced 3x duplicates for every JS/TS route:
- 2 real copies (express_routes + hapi_routes both matching same pattern)
- 1 ghost copy (module-level extraction with empty qualified_name)

Root causes in pass_parallel.c prescan_routes():
1. Function-level: cbm_extract_express_routes and cbm_extract_hapi_routes
   both extract the same Express-style routes from the same function body.
2. Module-level: cbm_extract_express_routes/hapi_routes called with "" as
   qualified_name, producing ghost nodes with empty file_path and QN
   starting with a leading dot (.route.GET.path).

Fix: deduplicate routes by (method, path) after Phase 1 collection, before
prefix resolution. When duplicates exist, prefer the entry with a non-empty
qualified_name (function-level entry wins over module-level ghost).

Verified: 3:1 dedup ratio. 0 ghosts, 0 duplicates after fix.
All routes have correct file_path and qualified_name.

Author: Your Name

src/pipeline/pass_httplinks.c

@@ -1402,6 +1402,45 @@ int cbm_pipeline_pass_httplinks(cbm_pipeline_ctx_t *ctx) {
 
     cbm_log_info("httplink.routes", "count", itoa_hl(route_count));
 
+    /* ── Phase 1b: Deduplicate routes by (method, path) ──────── */
+    /* Three sources of route duplication:
+     * 1. Module-level extraction (empty QN) re-discovers routes already found
+     *    at function level (non-empty QN) for the same (method, path).
+     * 2. Both extract_express_routes and extract_hapi_routes may match the
+     *    same route patterns in the same function body.
+     * Strategy: for each (method, path) group, keep the entry with the best
+     * qualified_name (non-empty wins over empty; longer wins over shorter). */
+    {
+        int deduped = 0;
+        for (int i = 0; i < route_count; i++) {
+            cbm_route_handler_t *a = &routes[i];
+            /* Check if a better or equal entry already exists */
+            bool dominated = false;
+            for (int j = 0; j < deduped; j++) {
+                cbm_route_handler_t *b = &routes[j];
+                if (strcmp(a->method, b->method) == 0 &&
+                    strcmp(a->path, b->path) == 0) {
+                    /* Same route — keep whichever has a better QN */
+                    if (a->qualified_name[0] && !b->qualified_name[0]) {
+                        /* a is better — replace b */
+                        *b = *a;
+                    }
+                    /* else b is better or equal — drop a */
+                    dominated = true;
+                    break;
+                }
+            }
+            if (!dominated) {
+                routes[deduped++] = *a;
+            }
+        }
+        if (deduped < route_count) {
+            cbm_log_info("httplink.dedup", "before", itoa_hl(route_count),
+                         "after", itoa_hl(deduped));
+            route_count = deduped;
+        }
+    }
+
     /* ── Phase 2: Resolve cross-file prefixes (serial) ────────── */
     resolve_cross_file_group_prefixes(ctx, routes, route_count);
     resolve_fastapi_prefixes(ctx, routes, route_count);