feat(artifacts): view-template role and J_DISPATCHES_TO from dispatch sites to the Artifact they reach

[rahlk]

Closes #259. Spec: codellm-devkit/.github#80 (docs/design/specs/2026-09-11-java-view-templates-and-dispatch.md).

What

• view-template role. ArtifactDiscovery classifies *.jsp *.jspx *.jspf *.tag *.tagx (format: jsp), *.xhtml (xhtml) and .html under templates/ or WEB-INF/ (html) as roles: ["view-template"]; faces-config.xml becomes tool-config. A bare .html elsewhere stays unknown — a static page and a Thymeleaf template are not distinguishable by name.
• return body nodes carry their expression in argument_expr (empty for a bare return). Population of an existing field, no schema addition.
• ViewDispatches, the same shape as ConfigUses: detection by declared receiver type (RequestDispatcher.forward / include, HttpServletResponse.sendRedirect, ModelAndView construction / setViewName, and a Spring entrypoint's String return), a literal tier at every level, the L3/L4 dataflow tiers widening it, and a target that closes on exactly one artifact or is recorded unresolved as non-literal / no-such-artifact / ambiguous. View names expand through spring.mvc.view.* when declared and spring.thymeleaf.* or Thymeleaf's defaults otherwise; redirect: / forward: prefixes re-dispatch as paths.
• DataflowTiers hoists the intra (DDG) and interprocedural (call-graph) tiers out of ConfigUses unchanged so both passes share them; Literals likewise for the string decoders.
• Both projections. application.view_dispatches[] {src, dst, via, prov} and view_dispatches_unresolved[] {site, callee, target, via, reason, prov} in analysis.json; J_DISPATCHES_TO {via, prov} from JBodyNode to Artifact in Neo4j. Unresolved dispatches have no target node and stay JSON-only. schema.neo4j.json diff is exactly the one relationship; schema_version stays 2.0.0.

Tests

• ArtifactDiscoveryTest: each rule, the bare-.html refusal, and plantsbywebsphere's view-template set pinned to its 16 JSP/Facelets files exactly.
• ReturnExpressionTest: literal, expression, bare return.
• ViewDispatchesTest: forward / include / redirect resolve; servlet URL → no-such-artifact; two dup.jsp → ambiguous; variable → non-literal; projection carries via/prov with both endpoints present and nothing for unresolved.
• ViewDispatchDataflowTierTest: a local closes at −a 3 (prov: ["dataflow"]), a parameter at −a 4; disagreeing definitions and two callers with different pages stay non-literal with both tiers listed as attempted; a traced literal naming no file is no-such-artifact.
• ViewNameDispatchTest: Thymeleaf defaults, declared spring.mvc.view.*, redirect: prefix, ModelAndView both forms, and the gate (return "home" outside a Spring entrypoint and a non-String return are not dispatches).
• CodeAnalyzerV2CliTest: end to end over a servlet fixture in both projections.

Full suite: 593 tests green except CodeAnalyzerIntegrationTest, which needs Docker.

Caveats (from #259)

• The servlet / Spring types must resolve for the pass to see anything — same condition config reads live with. The tests stub the API as fixture source for that reason.
• return nodes exist from L3, so a controller's return-based view name is invisible at −a 1; its ModelAndView sites are not.
• A dispatcher held in a local (rd.forward(...)) is non-literal for now (ponytail: comment in ViewDispatches.dispatcherArgument).
• via: "navigation" is reserved and emits nothing until a JSF entrypoint finder exists.
• Not re-run on DayTrader: the checkout used for the measurements in the spec is no longer on disk.

Follow-up

python-sdk: JViewDispatch / JViewDispatchUnresolved models, get_view_dispatches / get_view_dispatchers, Neo4j reconstruct — filed against the 3.3.0 wheel once it is cut.