fix(rules): handle empty matcher as unconditional rule

The matcherSignature function now treats empty strings as unconditional rules
that match any request,
returning "(any)" as the signature instead of
rejecting them.

This enables proper dead code detection when an unconditional
terminating rule shadows later rules.

Adds test coverage for detecting dead rules caused by unconditional
terminating rules.

internal/route/rules/rules.go

@@ -155,7 +155,7 @@ func ruleOnAlwaysTrue(on RuleOn) bool {
 func matcherSignature(raw string) (string, bool) {
 	raw = strings.TrimSpace(raw)
 	if raw == "" {
-		return "", false
+		return "(any)", true // unconditional rule
 	}
 
 	andParts := splitAnd(raw)

internal/route/rules/rules_test.go

@@ -124,6 +124,19 @@ header Host example.com {
 `,
 			want: nil,
 		},
+		{
+			name: "unconditional terminating rule shadows later unconditional rule",
+			rules: `
+{
+	error 404 "not found"
+}
+
+{
+	error 403 "forbidden"
+}
+`,
+			want: ErrDeadRule,
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {