Fix PointsPath codeshare matching with a route+time fallback key

[ak2k]

Summary

Today's matcher keys on (first-segment flight number, departure date). Codeshares break this: Matrix returns the marketing flight number (e.g. AA6939 JFK→LHR) while PointsPath returns the same physical aircraft under the operating flight number (e.g. BA174, surfaced inside the American PP query — PP attributes codeshares to the operator). AA6939 != BA174 → no award attaches even though one exists.

A live probe against PP's airline-search (research/probe_pp_matching.py) confirmed PP already surfaces the codeshares — they just hide behind operating flight numbers:

American query for JFK→LHR 2026-08-15 returned:
  AA100 18:10  (AA-operated)
  BA174 18:40  (BA-operated, AA-markets it as AA6939)
  BA180 19:10
  AA106 19:20
  BA116 20:20, BA114 21:40, BA182 22:40

So the fix is on our side. Match strategy is now:

Key	Pattern	Catches
primary	(flight#, date)	non-codeshares (unchanged)
fallback	(origin, dest, departure_to_minute)	codeshares — both Matrix and PP read the same airline-published schedule

Hits from both keys are unioned and deduped by OutboundFlight identity so non-codeshare flights aren't double-attached.

Minute-precision exact match (no tolerance window) — kept simple to start; real schedule-source drift between Matrix and PP is rare. If users hit it, extending to ±N min is a one-line change.

Closes work-22az.

Side findings from the probe (not in this PR)

• enableGoogleFlightMatching=true + a synthetic flight_id hint dropped the result list to 0 — likely PP needs real Google Flights IDs to anchor the match. Worth retrying inside work-qmx1 (gflight + PP overlay), where fli produces those IDs.
• BritishAirways returns "unsupported airline" on this Pro tier. Doesn't matter here — codeshares ride in via the operator's PP record under whichever airline PP enables.

Test plan

• make check (ruff lint + format + basedpyright strict + pytest) — all green
• 80/80 tests pass (69 existing + 11 new)
• New tests cover: codeshare match via fallback (AA6939↔BA174 from the probe), dedup when both keys hit the same flight, different-route rejection, minute-precision strictness, union of fn-match + route-time match
• Existing match-test net still passes — no regression for the non-codeshare path