refactor: split server.ts into routed modules

[debba]

Summary

src/server.ts was a 1475-line file mixing bootstrap, GraphQL documents, HTML scraping and a long chain of url.startsWith(...) checks. This PR splits it up and puts routing on find-my-way, the router used by Fastify, while keeping Node's native http request/response model.

File	Role
src/server.ts	bootstrap only (16 lines)
src/server/app.ts	builds the request handler: app routes, static files, API router, SPA fallback
src/server/router.ts	typed wrapper over find-my-way (RouteContext, 405 handling)
src/server/spa.ts	index.html serving and client-route detection
src/server/routes/*	one module per domain: auth, accounts, dashboard, repository, mentions, projects, notifications
src/server/graphql/*	GraphQL documents, separated from HTTP handlers
src/utils/dependents.ts	dependents HTML parser as pure logic, with tests

Repeated code is centralised: parseJsonBody, sendPayload, sendRedirect in http.ts; requireRepo / sendError in routes/shared.ts.

Behaviour changes

• Routes match by method and exact path instead of prefix. The frontend already uses exact paths for every endpoint, so no client change is needed.
• A wrong HTTP verb answers 405 with an Allow header and the same JSON body as before; per-handler req.method checks are gone.
• An unknown /api/* path answers a JSON 404 instead of index.html.
• Fixes the pre-existing type error in the GitLab OAuth callback handler.

Build

find-my-way is CommonJS and the ESM bundle produced by esbuild failed at startup with Dynamic require of "node:assert" is not supported. The build script now adds the standard createRequire banner.

Verification

• npm run typecheck: no errors in the new code (the 5 pre-existing errors in views, openaiDigest.ts and colors.test.ts are untouched).
• npm test: 23 files, 116 tests passing, including 8 new ones for the router and the dependents parser.
• Smoke-tested both node dist/server.js and tsx src/server.ts: SPA routes, static files, 401 without login, 400, 404 and 405 all respond as expected.