fix(server): point crawl errors at the crashing source

[dvd233]

What & why

reticle_verify crawl kept the clicked control's source on every anomaly, even when a console or uncaught error carried a more specific location for the code that actually failed. A navigation link could therefore reproduce a destination render crash while the report confidently pointed at the sidebar.

This change keeps the clicked control in ref / desc, but resolves console-fault source in this order:

1. first editable app frame in a React component stack carried directly or in the console message;
2. first editable app frame in the JavaScript error stack;
3. structured uncaught-error source + line;
4. clicked-control source as the existing fallback.

Dependency frames are skipped, browser/dev-server URLs are normalized to file-shaped paths, and unrelated colon-separated message text is not treated as a stack frame.

Closes #890

How it was verified

• Added focused crawl tests for the reported React Router case, JavaScript-stack fallback, structured uncaught-error location, false-positive resistance, clicked-control fallback, and missing-source behavior.
• packages/server/src/crawl/**: 6 files, 63 tests passed.
• packages/server/src/dispatch-attribution.test.ts + packages/server/src/events/event-filters.test.ts: 32 tests passed.
• Existing browser console-observer suite: 9 tests passed.
• Focused strict TypeScript check passed for the changed server surfaces.
• Focused ESLint passed with the repository's enforced TypeScript safety/correctness rules.
• Prettier, git diff --check, dependency-boundary guard, and lossy-transform guard passed.

The full pnpm lint && pnpm typecheck && pnpm test:unit gate was not run locally because this sparse checkout intentionally reused an existing dependency tree rather than installing the monorepo under the current disk-space constraint; CI will run the repository-native full matrix.

Gates run

• pnpm lint && pnpm typecheck && pnpm test:unit (~2 min — always)
• pnpm test:e2e (~8 min) — touched the tool surface, packages/core, an observer, or telemetry
• pnpm gate:install (~15 min) — touched reticle init, vite-plugin, next, or babel-plugin
• pnpm test:e2e:desktop (~3 min) — touched packages/electron, packages/tauri, or desktop capture
• None of the above tiers apply to this change

Checklist

• Every commit is signed off (git commit -s) — CI's DCO check fails the PR without it. Already pushed? git rebase --signoff origin/main && git push --force-with-lease
• Tests added/updated (RED → GREEN); the change is covered by a test that would fail without it
• No any, no free strings (wire strings live in @reticlehq/core), no non-null !
• No console.log or internal tracking codes left in the diff
• Each changed file is under the 1000-line cap
• Docs and CHANGELOG.md updated if this is user-facing (entry under [Unreleased])
• Security-affecting? Auth/redaction/trust-boundary changes keep the localhost-only, no-app-data-leaves-the-machine, no-arbitrary-JS posture (usage telemetry stays anonymous + opt-out per docs/telemetry.md) and are covered by a test — not security-affecting