fix(server): return JSON 404 for unknown /api/* routes instead of HTML

[buihongduc132]

What

All three servers (plan, review, annotate) serve the SPA HTML for any unmatched route. This means hitting /api/nonexistent returns the full HTML page with 200 OK — confusing for API clients, wasteful for bandwidth, and looks weird in logs.

Why

Ran into this while working on remote client mode — the client would hit /api/something with a typo and get back a giant HTML blob instead of a clean error. Would be better if API paths fail fast with JSON.

Changes

Added a 5-line guard in each server (index.ts, annotate.ts, review.ts) right before the SPA fallback:

if (url.pathname.startsWith("/api/")) {
  return Response.json({ error: "Not found", path: url.pathname }, { status: 404 });
}

Non-API paths (like /some/random/path) still serve HTML for SPA routing — no change there.

Testing

• 2 new tests verifying JSON 404 on unknown API routes and HTML 200 on non-API paths