fix ~0/~1 unescaping in decode_pointer_inplace

[nabhan06]

~1 decodes to the wrong byte in decode_pointer_inplace

This runs on the final path segment of JSON Patch add/remove/replace/move/copy ops. The ~1 branch wrote / to decoded_string[1] instead of decoded_string[0], and plain characters were never copied into the compacted slot once an escape had shifted the write position, so they kept whatever stale byte was already there. A path like /a~1b then resolved to a mangled key, so the operation landed on the wrong member or failed outright (/m~0n decoded to m~0, /a~1b to a~/).

Writing to decoded_string[0] and copying the non-escaped characters makes the result match RFC 6901 (~01 -> ~1, ~10 -> /0). Added patch cases with escaped keys in the destination segment, which exercise the decode path that the existing suite only reached through test ops (those go through compare_pointers, not this decoder).