fix(routes): canonicalize path parameters so client calls match handlers (#505)

[imateusdev]

What does this PR do?

Canonicalizes route-path parameter placeholders when building Route QNs so that
a client HTTP_CALLS and the server handler that serves it rendezvous on the same
Route node even when each side uses a different framework's placeholder syntax
(or a different parameter name).

Fixes #505.

Problem

Route QNs (__route__METHOD__/path) are the rendezvous key, but they were built
from the raw path. A Rust/Axum handler GET /players/{id} and a TypeScript client
call /players/:id therefore produced different QNs and never joined. Static
routes joined fine; parameterized routes (the bulk of a REST surface) did not:

Route<-[:HTTP_CALLS]- ∩ Route<-[:HANDLES]-  ==  ∅   (for parameterized paths)

Fix

New shared helper cbm_route_canon_path() (declared in pipeline_internal.h,
defined in pass_route_nodes.c) collapses each parameter token to a single {}:

Input	Canonical
/players/:id	/players/{}
/players/{id}	/players/{}
/users/<int:id>	/users/{}
/players/${id}	/players/{}
/orders/{id}/items/{itemIndex}	/orders/{}/items/{}

Applied to the path at every HTTP-route QN construction site
(pass_route_nodes.c, pass_parallel.c, pass_calls.c, pass_cross_repo.c);
broker/async/infra QNs are left untouched. The Route node's display name keeps
the original path — only the QN (identity/dedup key) is canonicalized — so the
existing ANY-vs-method reconciliation does the rest, exactly as it already does
for static routes.

Design note / tradeoff

Parameter names are intentionally discarded: /users/{id} and /users/{slug}
canonicalize to the same node. For REST surfaces these are virtually always the
same logical endpoint; flagging it here for reviewer visibility.

Tests

tests/test_route_canon.c — 11 unit cases covering each placeholder syntax, the
:id↔{id} convergence invariant, parameter-name agnosticism, literal : mid
segment, multiple params, NULL/empty, and tight-buffer truncation safety.

Verification

• make -f Makefile.cbm cbm — clean build (-Wall -Wextra -Werror).
• make -f Makefile.cbm test — full ASan/UBSan suite; the new route_canon
  suite passes 11/11 and no previously-passing test regresses.
• clang-format-18 --dry-run --Werror clean on all changed files.

Checklist

• Every commit is signed off (git commit -s)
• Tests pass locally
• Lint passes (clang-format) on changed files
• New behavior is covered by a test (reproduce-first)