Refactor: Extract shared route handlers and modularize plan server

[backnotprop]

Problem

packages/server/index.ts has grown to 705 lines with 13 inline route handlers. Additionally, several handlers are duplicated verbatim across all 3 server files:

• /api/image — identical in index.ts, review.ts, annotate.ts (19 lines x 3)
• /api/upload — identical in all 3 (23 lines x 3)
• /api/agents — identical in index.ts and review.ts (16 lines x 2)

~120 lines of pure duplication. Any change to these handlers requires editing 3 files identically.

Proposed Changes

1. Extract shared handlers → routes/shared.ts

Pull handleImage(), handleUpload(), and handleAgents() into shared functions that all 3 servers call. Eliminates the triple duplication.

2. Extract reference/doc handlers → routes/reference.ts

Move the vault browser endpoints (/api/reference/obsidian/files, /api/reference/obsidian/doc), the existing /api/doc handler, plus buildFileTree and VaultNode type. These are all "serve a file from some source" logic and are only used by the plan server.

3. Keep approve/deny inline

These are tightly coupled to the plan server's decision promise and integration logic. Not worth extracting.

Expected Result

• index.ts drops from ~705 to ~350 lines
• review.ts and annotate.ts each drop by ~40 lines
• Shared handler changes only need to be made in one place

What NOT to do

• No router abstraction or middleware — the if-chain pattern is fine
• No one-file-per-handler fragmentation
• No structural changes to review.ts or annotate.ts beyond swapping in shared handlers

[backnotprop]

The server extraction was completed in PR #211 (commit 0916809) and the code review confirmed it was clean — no bugs, all handler extractions behavior-preserving, security checks faithfully reproduced. However, PR #211 was closed because unrelated biome lint changes in the same branch introduced regressions (see #213).

This work should be cherry-picked into a clean PR. The commit 0916809 stands alone and doesn't depend on the biome changes.