Narrow WebApp.API server detection false positives

[Copilot]

Addresses remaining review feedback where client-only or non-HTTP framework usage could be classified as exposed APIs. Tightens server signals while preserving real API detections and Kotlin source resolution.

• Rule precision

  • DRF: replaces generic rest_framework import matching with API view/viewset/router signals.
  • NestJS: removes @nestjs/common import matching; uses controller decorators.
  • Spring: gates mapping annotations on controller context to avoid OpenFeign clients.
  • JAX-RS: detects resource/application classes or server registration instead of annotation imports.

• Regression coverage

  • Adds positives and negatives for serializer-only DRF, Injectable-only NestJS, OpenFeign clients, declarative/programmatic JAX-RS clients, and mixed client/server files.
  • Adds language resolution coverage for .kt while preserving .kts.

• Buildability

  • Repairs a PR-head RuleProcessor merge artifact so sync/async analysis continues through the shared capture-filtering path.

Example behavior:

@RegisterRestClient
@Path("/remote")
interface RemoteClient {
    @GET String get(); // no WebApp.API finding
}

@Path("/local")
public class LocalResource {
    @GET public String get() { return "ok"; } // WebApp.API.Java.JaxRs
}

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.