chore: bump dev data-fair image to v6, always-serve SPA

[BatLeDev]

Two small dev/test infra changes, grouped together.

What changed

• docker-compose.yml: dev data-fair image 5 → 6 (aligns the dev upstream with the v6 registry integration already on master).
• api/src/app.ts: the SPA middleware now mounts in all environments (the NODE_ENV !== 'development' guard was removed). Beyond serving ui/dist, this middleware also serves the runtime ui-config that the SPA fetches at startup — so it is required even in dev, where Vite (through nginx) serves the UI assets but not that config.

Why
Run the dev stack against data-fair v6; serve the runtime ui-config from the API in dev too (Vite serving the UI assets isn't enough).

Regression risks

• api/src/app.ts: the SPA middleware (incl. the vjsf CSP directives and the static ui/dist fallback) now also mounts in dev. UI routes are still handled by Vite/nginx ahead of the API, so the static fallback is effectively inert in dev; the meaningful effect is that the ui-config is now served. Worth a sanity check that the dev request flow is otherwise unchanged.
• data-fair:6 is a major bump of the dev upstream (dev/test only); registry/plugin integration assumptions may differ from v5.

Two changes from earlier revisions of this branch were dropped: the package-lock.json churn (no package.json change → broke npm ci), and persisting registry tarballs to a ./data/registry host bind mount (Docker created ./data as root, breaking the dev API's data/development mkdir and failing the api tests; the registry runs as uid 1000, so a host bind mount can't be written without an init/chown step).