fix: sort programmatic routes by specificity to prevent shadowing

[SisyphusZheng]

Routes registered via app.route() / app.get() are matched in registration order (first-wins). File-system routes go through sortRoutePaths() which orders by specificity, but programmatic routes bypass this entirely. This means registering a catch-all before a specific route silently shadows it:

app.route("/blog/[...rest]", handlerA);  // catches everything
app.route("/blog/[id]", handlerB);        // NEVER reached

This PR sorts #dynamicArr whenever a new dynamic route is added, using the same specificity scoring as sortRoutePaths: static segments > dynamic [id] > catch-all [...rest].

Closes #3861