[codex] extract spa and cable backend boundaries

[hugodeco]

What changed

This slice consolidates the backend work around the PR #39 evaluation and the new realtime foundation.

• adds the initial SPA-oriented backend routes and controllers for login, server control, history download, and owned-server reads
• introduces the websocket cable module as a transport-neutral command/event bus for multi-connection realtime usage
• extracts API response DTOs out of src/models into src/api/models
• moves form-only page/view data into src/form/viewmodel
• removes obsolete v1/v2 compatibility types from src/models
• pins sqlite to the stable go-sqlite3 v1.14.42 replacement to avoid the known warning from the accidental v2.0.3+incompatible tag
• improves inline/package documentation in the areas touched by this recorte

Why this changed

The main goal is to stop src/models from remaining the default dumping ground for transport, form, compatibility, and realtime concerns.

This PR creates a cleaner backend boundary before the next refactors, especially around send/request contracts and future runtime/store separation.

Impact

• backend now has a documented websocket/cable base for commands and events
• API and form transports no longer depend on several legacy structs living in models
• legacy v1/v2 backend compatibility code has been removed
• the environment endpoint tests were updated to validate the current response envelope

Validation

• go test ./... in src/api
• go test ./... in src/form
• go test github.com/nocodeleaks/quepasa/models github.com/nocodeleaks/quepasa/cable github.com/nocodeleaks/quepasa/webserver
• go test ./... in src