feat(routes): cora routes command + fix route detection

[ajianaz]

Summary

Implements the primary acceptance criterion of #438 — a cora routes command that lists detected HTTP endpoints — and fixes two correctness bugs in the existing route detection that produced wrong handler names and dropped the HTTP method.

Closes #438.

What changed

Detection fixes (src/index/extract.rs::detect_routes)

Route detection already existed and was wired into indexing, but the extracted data was wrong:

Before	After
source = "get" for every Axum route (group 2 = method fn)	source = "health_check" (group 3 = handler)
target = "/api/health" (method dropped)	target = "GET /api/health"
source = "routes" for routes::health::health_check	source = "health_check" (final segment)

• Axum/Actix handler is now capture group 3 (the actual handler), not group 2 (the method fn like get/post).
• HTTP method is captured and prefixed to the target.
• Fully-qualified handler paths (routes::health::health_check) are captured in full ([\w:]+) and reduced to the final segment so the edge source matches the indexed function symbol.
• Removed the dead extract_http_method helper — it checked the regex string for a label substring that never appeared, so it always returned "".

New command (src/commands/routes.rs)

cora routes                 # list all detected endpoints
cora routes --method GET    # filter by HTTP method (case-insensitive)
cora routes --prefix /api   # filter by path prefix
cora routes --json          # structured output

Routes already appear in cora arch edge distribution (kind = ROUTE).

Verification

End-to-end against the hompimpah Axum backend (10 routes):

$ cora routes
Detected HTTP routes (10)
──────────────────────────────────────────────────────
  GET     /api/health                               health_check → server/src/lib.rs:47
  GET     /api/auth/providers                       list_providers → server/src/lib.rs:48
  GET     /api/auth/{provider}/login                login → server/src/lib.rs:49
  POST    /api/auth/logout                          logout → server/src/lib.rs:51
  POST    /api/progress                             submit_progress → server/src/lib.rs:53
  ...

$ cora routes --method POST
  POST    /api/auth/logout                          logout → server/src/lib.rs:51
  POST    /api/progress                             submit_progress → server/src/lib.rs:53

Checks

• cargo fmt --all -- --check ✅
• cargo clippy --all-targets -- -D warnings ✅
• cargo test ✅ (785 tests, including +6 detect_routes and +4 routes tests)
• Pre-commit cora review ✅ passed on this diff

Out of scope (follow-ups)

Two secondary criteria from #438 are not addressed here and warrant separate work:

• Routes as symbols in brain search — routes are currently edges, and brain searches the symbols table. Surfacing them needs a Route symbol kind.
• cora query "/api/users -> *" tracing route → handler — cora query reads the call_graph table, while ROUTE edges live in edges. Only cora trace/cora impact (the _edges variants) traverse ROUTE today.

These are tracked conceptally in #438 and can be follow-up issues.

Related

• enhancement: cora dead-code ~82% false positives on framework-called methods (Phaser/SvelteKit); needs symbol-level skip #452 — cora dead-code false positives on route handlers. Note: find_dead_code reads call_graph only, so ROUTE edges in edges do not yet suppress handlers — that fix is part of enhancement: cora dead-code ~82% false positives on framework-called methods (Phaser/SvelteKit); needs symbol-level skip #452, not this PR.