Precision: FastAPI/Flask route definitions counted as external endpoints (distinct from test-fixture noise #137)

[AndresL230]

Part of #142. Sibling of #137.

Summary

The scanner emits an app's own route definitions as external "endpoints". In sapling/backend, ~141 of 215 endpoints are @router.get/post(...) definitions in production routes/*.py (e.g. routes/social.py, routes/admin.py, routes/learn.py) — the program's own API surface, not outbound spend.

This is distinct from #137, which covers test-fixture / compiled-test files via path exclusion. These route-defs live in production source, so #137's exclusions will not catch them — they need to be told apart from outbound calls by kind, not by path.

Root cause

The regex pass emits any /-prefixed literal as an endpoint:

• src/scanner/core-scanner.ts:284 — matchRouteDefinitionLine(line)
• src/scanner/core-scanner.ts:310 — matchLine(line)
• gated only by isHighConfidenceUrl (:95-107), which accepts any http(s):// or /-prefixed string.

A decorator route definition and an outbound call to a path are indistinguishable to it. endpoint-classification.ts marks these internal, but they still land in result.endpoints and inflate the cost/count surfaces.

Proposed fix

• Detect route-definition context — Python decorator @app.<verb>(...) / @router.<verb>(...); Express app.get(path, handler) registration — and classify as kind: "route-def" / scope: "internal-route".
• Keep route-defs out of the external-spend endpoint list and the cost summary. Optionally surface them in a separate "your API surface" bucket — never "external".
• Coordinate with Scanner counts test fixtures / compiled-test output as production endpoints → inflated cost #137 so production route-defs and test-fixture calls are both excluded from external cost via one classification path.

Acceptance criteria

• A scan of sapling/backend reports 0 external endpoints sourced from @router.* route definitions.
• Route-defs do not contribute to totalMonthlyCost / external totalEndpoints.
• Genuine outbound calls in the same route files are still detected.