Fix medium-severity audit findings across router, hooks, and matcher

[ConsoleTVs]

Summary

React Hooks

• Fix useSearchParams subscription tearing by introducing UrlContext — search params now derive from React state instead of the mutable navigation.currentEntry, preventing concurrent-mode tearing
• Fix setSearchParams silently dropping the URL hash fragment when updating search parameters
• Fix canGoBack/canGoForward not being reactive — useBack and useForward now subscribe to the currententrychange event and keep their boolean in React state

Route Builder (createRouter)

• Add static redirect cycle detection — self-redirects and multi-hop loops throw at registration time
• Guard route builder against reuse after terminal methods (.render(), .redirect(), .group()) — calling any method on a consumed builder now throws a descriptive error
• Export new UrlContext from the barrel

Matcher

• Throw on duplicate route registration instead of silently overwriting — prevents accidental route shadowing
• Add per-matcher prefetch deduplication via WeakMap<Matcher, Set<string>> cache to prevent thundering-herd when many <Link> components point to the same destination

Type Safety

• Fix NavigationContext typed as Context<Navigation> (using null as unknown as Navigation) but actually defaulting to null — now correctly typed as Context<Navigation | null>

Tests

• 26 new tests (195 → 221), all passing
• New test suites: redirect cycle detection, builder consumed guard, duplicate route registration, hash preservation, null UrlContext fallback

Breaking Changes

NavigationContext type changed to Context<Navigation | null>

What changed: The context default is now properly typed as nullable instead of using null as unknown as Navigation.

Migration: Code using use(NavigationContext) directly must handle the null case. The useNavigation() hook already throws a descriptive error on null, so hook consumers are unaffected.

Why: The previous typing masked a runtime null value, causing potential crashes when consumed outside a Router.

matcher.register() throws on duplicate patterns

What changed: Registering the same path pattern twice now throws instead of silently overwriting.

Migration: Remove duplicate route registrations. If intentional overwriting is needed, create a new matcher.

Why: Silent overwriting caused hard-to-debug routing bugs where the last registration would win.

Route builder throws on reuse after terminal methods

What changed: Calling .middleware(), .scroll(), etc. after .render()/.redirect()/.group() now throws.

Migration: Create a new builder via route('/path') for each route instead of reusing a consumed builder.

Why: Reusing a consumed builder led to confusing behavior where configuration appeared to be set but was silently ignored.