[DeusData]

match_http_routes linked every outbound HTTP_CALLS to any other indexed
project exposing the same method/path, without first asking whether the
caller's own project serves that route. A repo whose own frontend calls
its own API (the common case) got a cross-service edge to every other
project that happens to expose the same path, e.g. /health or /api/users.

Add a caller-local floor: before looking at the target, the pass checks
whether the call is served in the caller's own project, and skips it if
so. "Served" is a HANDLES edge on the Route node the HTTP_CALLS points
at, or the same exact-method / ANY / template resolution already used
for the target, applied to the caller's own store. The second check is
needed on real input: a method-less fetch('/api/users') points at the
route__ANY node, while the local app.get handler sits on the
route__GET node. The target lookup is factored into
resolve_route_handler() so both sides use one resolver.

Since match_http_routes also runs in the provider-side (reverse)
direction, the floor applies there too. Calls with no local handler
still cross as before.

Proof (dev binary, three small Express fixtures, api/mono both serving
GET /api/users, mono and client both fetching it):
mono -> [api] cross_http_calls 1 -> 0
client -> [api] cross_http_calls 1 -> 1 (control)
api -> [mono, client] cross_http_calls 2 -> 1

Refs #1459 (the per-edge evidence/ambiguity shape and the opt-in gateway
binding discussed there remain open).

---

Merge order: land this before the NestJS route PR for #1428. Touches src/pipeline/pass_cross_repo.c next to the #1133 PR (different hunks; a git merge-tree dry run merges cleanly).