refactor(server): harden demo HTTP server

[taigrr]

Summary

• move route registration into a dedicated mux constructor for easier testing
• serve the demo app through an explicit http.Server with a read-header timeout
• add main-package tests that cover the registered routes and server configuration

Testing

• go test ./...
• go test -race ./...
• staticcheck ./...