fix: reserve API misses for JSON responses (#158)

[atomantic]

Summary

• add a terminal JSON 404 boundary for every unmatched /api method before the production SPA fallback
• extract the assembled Express application into a testable factory while keeping startup-only lifecycle work in index.ts
• document API payload exceptions and cover API misses, registered routes, and SPA navigation with the production route order

Test plan

• npm test -- --run
• npx vitest run tests/integration
• npm run build
• npm run check:file-sizes

Closes #158