v0.9.0 — Fixes a phantom-worktree bug, adds Next.js App Router support

The headline bug fix

Dogfooding archsteer on its own repo surfaced a real, embarrassing bug: .claude/ was never in the ignore list. A Claude Code subagent's git worktree under .claude/worktrees/<id>/ is a full duplicate checkout of the repo — scanning it double-counted every component, and in one sample run, 100% of the reported "raw SQL" violations turned out to be phantom (0% were real). This affects every user running archsteer inside a Claude Code project, not just this repo. .cursor/, .hg/, and .svn/ are now excluded too.

Next.js App Router support (new)

• New nextjs-app-router starter pack — layers inferred from Next.js's own reserved filenames (page.tsx → page, layout.tsx → layout, route.ts → api, regardless of directory) before falling back to directory names. Rules: data access (Supabase/Prisma/raw SQL) and third-party calls confined to lib/ or a route handler; no hardcoded secrets.
• init now tells a real Next.js App Router app apart from an Express repo migrating to Next — next + an app/ dir + no express gets the new pack; anything with express still gets the migration-flavored express-to-next pack, even once next shows up as a dependency.
• Supabase query detection — .from("table").select(/insert/update/upsert/delete)(...), including calls chained across lines, now registers as data access (same as the existing Prisma/SQLAlchemy/raw-SQL detectors).

Two false-positive fixes with broad real-world impact

• fetch('/api/x') is no longer flagged as an external call. A component calling its own Next.js route handler was previously indistinguishable from fetch('https://stripe.com/...') — same-origin relative-path fetches are now excluded, and absolute URLs get a real hostname as the destination label instead of a generic HTTP_CLIENT_CALL.
• @/lib/x-style imports now resolve to real internal edges. This is the default alias in every create-next-app project — without tsconfig.json/jsconfig.json paths resolution, every one of these imports was textually indistinguishable from a third-party package, leaving the layer diagram edge-less on most real Next.js/TS repos. (Along the way, fixed a bug in the JSONC comment-stripper itself: it read the / inside the string "@/*" as a block-comment start and corrupted the JSON — fixed with a string-literal-aware tokenizer.)

Validation

Re-ran end to end on archsteer's own web/ app: unassigned components dropped from 52% to 14%, the Mermaid diagram went from zero edges to a real page→lib, page→ui, ui→lib, layout→ui, api→lib picture, and the conformance score is now a genuinely exercised 100% (real Supabase calls and real external calls are present and correctly placed) rather than a vacuous one computed against rules that didn't apply to the repo at all. Spring PetClinic (100%) and trailheadapps/dreamhouse-lwc (95.3%) benchmarks unchanged — no regressions.

Full diff: v0.8.0...v0.9.0