fix(market): 404 JSON for unknown API routes + OAuth ops runbook

[bobleer]

Summary

Distills what we learned configuring GitHub OAuth on the production market server (2026-07-29/30) back into the repo.

Code — src/crates/services/miniapp-market-service:

• Unmatched /miniapp/api/v1/* paths used to fall through to the SPA and return 200 + index.html, which made API debugging genuinely confusing (a typoed auth path looks like a live endpoint). Because axum flattens nested routers, a nested .fallback() loses to the outer /miniapp/{*rest} catch-all — so this registers an explicit /{*rest} wildcard inside the API router instead. Unknown API routes now return the standard versioned 404 JSON envelope.
• Regression test added (health_route_boots_with_an_empty_database now also asserts the 404 envelope).

Docs — deploy/miniapp-market/README.md:

• New「GitHub OAuth 配置」subsection: OAuth Apps have no management API (manual web-only), client secrets display exactly once (reuse the app, rotate the secret), don't pass secrets as CLI args, plus read-only verification commands (health → githubAuthConfigured:true, /auth/github/start → 307 to GitHub with matching client_id/redirect_uri).
• Documented the SPA-fallback debugging pitfall for older deployed versions.
• Gave「初次开放市场」its own subsection heading.

Testing

• cargo test -p bitfun-miniapp-market-service — 19 passed
• cargo check -p bitfun-miniapp-market-server — clean
• cargo fmt --check — clean