fix(doctor): resolve route checks by matching, not flat app.routes scan

[tachyon-beep]

Problem

filigree doctor fails (exit 1) with false-positive "missing route" errors on any install that resolves FastAPI ≥ 0.137:

!! Scan results routes: Missing route(s): POST /api/weft/scan-results, POST /api/scan-results, GET /api/files/_schema
!! Entity association routes: Missing route(s): GET/POST/DELETE /api/issue/{issue_id}/entity-associations, GET /api/entity-associations

The routes are served correctly at runtime — only the doctor's static introspection is fooled.

Root cause

FastAPI 0.137 made include_router lazy: child routes are mounted behind a fastapi.routing._IncludedRouter wrapper whose child paths stay unprefixed and compose the /api (and /weft) prefix only at match time. The doctor built a route table by flat-scanning app.routes for .path strings — under 0.137 it sees the wrapper's empty path and concludes every included route is missing.

CI never caught it because uv.lock pinned FastAPI 0.136.3 (which still eager-flattens) while real uv tool installs resolve 0.137.x. Classic "green in CI, broken in the field."

Discovered investigating an "old install" (esper-lite) whose doctor showed these errors. The data store was fully current (schema v28) — the breakage was the opposite of stale: a freshly-resolved newer FastAPI.

Fix

• _route_supports now resolves routes via Starlette matching (route.matches(scope)) instead of path-string scanning — version-agnostic, method-aware, prefix-composing. Works on both old and new FastAPI.
• uv.lock moves forward to FastAPI 0.137.1 / Starlette 1.3.1 so CI exercises the version field installs receive. No upper cap added (the matching fix is version-agnostic by design).
• Closed two pre-existing test-hygiene connection leaks the bump's newer TestClient unmasked via GC timing (tests abandoning a _attempt_startup-opened DB without closing it, tripping the suite's error::ResourceWarning filter). Matches the close-after-startup pattern the sibling _attempt_startup tests already use.
• Bumps to 3.0.1 so fixed installs are distinguishable from the 3.0.0 builds carrying the false-positive.

Tests

• New TestRouteSupports (RED-first against the real 0.137 bug): included-router detection, HTTP-method enforcement, absent-route handling.
• Existing test_run_doctor_emits_real_route_and_auth_checks now genuinely exercises 0.137.
• Full pipeline green: ruff · ruff format · mypy (112 files) · pytest.

Field rollout

Existing installs need a uv tool install --reinstall of 3.0.1 — not a data migration. Their stores are already current.

🤖 Generated with Claude Code