parse fastify routes

[TheGreenCedar]

Context

Fastify was still extracted by a receiver-name line scanner. It missed multiline and .route(...) registrations, accepted unrelated server.get calls, and could not prove receiver ownership or safe handler edges.

What Changed

• Added parser-backed Fastify extraction for JavaScript, JSX, TypeScript, and TSX using the existing query caches and source-ordered binding utilities.
• Proved module-scope Fastify receiver ownership across ESM/CommonJS aliases, transparent TypeScript wrappers, reassignment, update writes, shadowing, declarations, exported runtime declarations, and nested initializer writes.
• Added direct verbs including TRACE and static .route({ method, url, handler }) objects with duplicate/dynamic property rejection.
• Preserved probable handler edges only for direct identifiers/member expressions; wrapped and inline handlers do not invent edges.
• Restricted malformed-source fallback to error-local, direct module statements with proven ownership and whole static expressions; nested control-flow registrations and comment-shaped properties fail closed.
• Kept CommonJS provenance narrow: direct require("fastify") aliases and destructured fastify aliases are supported without promoting mutable alias-member factories.
• Updated coverage claims, language/route docs, changelog, and a measured old scanner versus parser truth set.

How To Review

Review framework_routes.rs in order: query/object extraction, malformed fallback, query/binding ownership, transparent wrappers and write invalidation, then the Fastify regression matrix. In lib.rs, confirm Fastify alone moved to the parser adapter and handler reconciliation remains conservative.

Verification

• Fastify focused suite: 8/8; parser truth set TP=5, FP=0, FN=0 versus old scanner TP=0, FP=6, FN=5.
• Full indexer library: 184/184.
• Full fidelity_regression: 8/8.
• Full tictactoe_language_coverage: 12/12.
• Runtime framework coverage contract: 1/1.
• cargo clippy -p codestory-indexer -p codestory-runtime --all-targets -- -D warnings.
• cargo fmt --all -- --check.
• Documentation links: 69 files / 281 relative links.
• git diff --check origin/dev/codestory-next...HEAD.
• Independent full-source review: CLEAN after fixing update/declaration invalidation, nested malformed scope, TypeScript/CJS transparent wrappers, comment-shaped fallback properties, and mutable CommonJS member provenance.
• Final rebase/readback: head 12d13962 on dev/codestory-next 30064e9f; focused Fastify and runtime coverage tests rerun after the final fetch.
• The required ignored repo e2e stats binary was previously invoked but could not emit stats because CODESTORY_REAL_REPO_DRILL_CASES was unset and no bge-base-en-v1.5.Q8_0.gguf model directory existed. No stats success is claimed.

Risk

Fastify plugin-prefix propagation and runtime middleware/schema semantics remain out of scope, so confidence stays heuristic despite parser-backed provenance. Malformed recovery remains structural only. No dependency or generic framework abstraction was added.

Closes #979
Refs #920
Refs #899