fix: Pass 2 hash_size was overwriting ADVERT-derived values

Pass 1 correctly uses last-wins for ADVERT packets. But Pass 2
(fallback for nodes without ADVERTs) was also unconditionally
overwriting, so a stale 1-byte non-ADVERT packet would clobber
the correct 2-byte value from Pass 1.

Restored the !hashSizeMap.has() guard on Pass 2 only — it should
only fill gaps, never override ADVERT-derived hash_size.

server.js

@@ -1111,7 +1111,7 @@ app.get('/api/nodes', (req, res) => {
             if (p.decoded_json) {
               const d = JSON.parse(p.decoded_json);
               const pk = d.pubKey || d.public_key;
-              if (pk) hashSizeMap.set(pk, hs);
+              if (pk && !hashSizeMap.has(pk)) hashSizeMap.set(pk, hs);
             }
           }
         }