Make AddRoute idempotent (upsert instead of reject duplicates)

AddRoute now updates an existing route if one already exists for the
same (listener, hostname) pair, instead of returning AlreadyExists.
This makes repeated deploys idempotent — the MCP agent can register
routes on every deploy without needing to remove them first.

- DB: INSERT ... ON CONFLICT DO UPDATE (SQLite upsert)
- In-memory: overwrite existing route unconditionally
- gRPC: error code changed from AlreadyExists to Internal (for real DB errors)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/db/db_test.go

@@ -250,15 +250,30 @@ func TestRouteL7Fields(t *testing.T) {
 	}
 }
 
-func TestRouteDuplicateHostname(t *testing.T) {
+func TestRouteUpsert(t *testing.T) {
 	store := openTestDB(t)
 
 	listenerID, _ := store.CreateListener(":443", false, 0)
 	if _, err := store.CreateRoute(listenerID, "example.com", "127.0.0.1:8443", "l4", "", "", false, false); err != nil {
 		t.Fatalf("first create: %v", err)
 	}
-	if _, err := store.CreateRoute(listenerID, "example.com", "127.0.0.1:9443", "l4", "", "", false, false); err == nil {
-		t.Fatal("expected error for duplicate hostname on same listener")
+	// Same (listener, hostname) with different backend — should upsert, not error.
+	if _, err := store.CreateRoute(listenerID, "example.com", "127.0.0.1:9443", "l7", "/cert.pem", "/key.pem", false, false); err != nil {
+		t.Fatalf("upsert: %v", err)
+	}
+
+	routes, err := store.ListRoutes(listenerID)
+	if err != nil {
+		t.Fatalf("list routes: %v", err)
+	}
+	if len(routes) != 1 {
+		t.Fatalf("expected 1 route after upsert, got %d", len(routes))
+	}
+	if routes[0].Backend != "127.0.0.1:9443" {
+		t.Fatalf("expected updated backend, got %q", routes[0].Backend)
+	}
+	if routes[0].Mode != "l7" {
+		t.Fatalf("expected updated mode, got %q", routes[0].Mode)
 	}
 }