Bound captured extension route backtracking

[agrafix]

Motivation

• The PI_Extension parser enumerated every dot split for captured extensions and reparsed the left-hand pattern for each candidate, causing combinatorial backtracking and a CPU DoS risk for routes with chained captured extensions.
• The intent is to bound attacker-controlled work during route selection while preserving behavior for fixed literal extensions.

Description

• Added an early rejection in parsePrefix for PI_Extension that returns Nothing when the right-hand side requires split enumeration and the incoming segment contains more than maximumExtensionSeparators dots, implemented in reroute/src/Web/Routing/SafeRouting.hs.
• Introduced maximumExtensionSeparators :: Int (set to 16) and helper extensionNeedsSearch so fixed literal suffix paths (PI_StaticCons and PI_Empty) keep the existing fast single-split behavior.
• Kept the existing extensionSplits/dotSplits behavior for normal cases so functionality is preserved for benign inputs and literal extensions.
• Added regression tests in reroute/test/Web/Routing/SafeRoutingSpec.hs that assert adversarial chained-capture inputs are rejected and that many-dot filenames still match fixed literal extensions.

Testing

• Ran git diff --check to validate patch formatting and it passed.
• Executed a small Python combinatorics check validating the chosen bound (sum of combinations up to 16 equals 2^16) and it passed.
• The Haskell test-suite (cabal/stack/ghc) was not executed because the toolchain is not available in the environment, so reroute tests were not run locally.

---

Codex Task