[Routing] Expand route request matrix coverage

[cssbruno]

Source: split follow-up from #237 after the #61 routing/layout/view baseline.

Scope:

• Expand direct-refresh, generated 404, path-traversal, and encoded-param request tests beyond the current SPA, SSR, API, action, fragment, trailing-slash, and dynamic route coverage.
• Cover generated app behavior where request normalization, route matching, and response status can diverge from compiler validation.
• Keep path traversal and encoded-param tests focused on generated app/runtime behavior, not only parser validation.

Acceptance criteria:

• Focused tests cover the added request matrix for build output and/or generated apps as applicable.
• docs/reference/routing.md is updated only when behavior changes or newly stable behavior is documented.
• Unsafe traversal or ambiguous encoded paths fail before they can resolve to unintended generated assets or routes.
• Existing direct-open/refresh behavior for generated SPA and request-time pages remains intact.

Related: #61, #237.