feat(server): runtime /config + /api prefix + bundled static frontend

Wires every router added in earlier commits into the Express app and
adds the runtime-config endpoint that the browser bundle reads at
startup.

  * routes/config.ts mounted at /config - returns
    { authProvider, entra: { tenantId, clientId } } from server env.
    Unauthenticated; lets the same Docker image ship to any tenant.

  * /api prefix shift - every existing API router moves under /api/* so
    the backend can also serve a static frontend bundle from the same
    process (the SPA shell at / would otherwise collide).
    /install and /config keep their current paths because they have
    independent meaning at the root.

  * Static frontend bundle.  When PUBLIC_DIR (../public relative to
    dist/index.js) exists, the backend serves the Next.js static export
    out of the same Express process.  findShell() resolves dynamic-
    segment routes like /projects/<id> back to the right shell file
    that Next.js export emits with `_` placeholders.  RSC `.txt`
    requests for unmapped routes 404 cleanly so Next falls back to a
    hard navigation.  When PUBLIC_DIR is absent (local backend dev),
    the static handler is skipped and the frontend dev server at :3000
    talks to this backend over CORS as before.

  * trust-proxy + cookie-parser + urlencoded body parser added to
    support OAuth state cookies, the configurator's signed sessions,
    and the bootstrap-token paste form respectively.