v0.37.1 — fix docs-surfaced papercuts

A patch fixing framework papercuts surfaced while writing the API-reference docs.

• make:* stubs now import from @shaferllc/keel/core (the published entry point) instead of the internal @keel/core alias, so scaffolded files compile in a real project.
• Connection.select is no longer generic — it returns Promise<Row[]>, so a driver implementation drops the as Connection cast. db<T>() still types results.
• hash.verify returns false on a malformed hash instead of throwing.
• Sessions serialize cookies UTF-8-safe — emoji / non-Latin1 values no longer crash the response.
• router.url() substitutes every occurrence of a repeated :param and won't match inside a longer param name.

Regression tests added for hash, session, and url. 195 tests; type-checked doc examples.