M2-T11: serve React SPA from FastAPI and remove Jinja pages

- app/main.py serves the SPA build (SPA_DIST_DIR, default frontend/dist):
  mounts /assets and a GET catch-all returning index.html for client routes;
  catch-all 404s on /api/*, never swallows /docs, /openapi.json, /static, assets,
  ingestion/ticktick/status; skips SPA serving when dist absent (backend-only CI)
- delete app/api/routes/pages.py, app/api/routes/auth.py, app/templates/
  (all replaced by /api/* + SPA; auth service layer kept)
- remove/replace Jinja page tests (JSON coverage already in test_api_*);
  add tests/test_spa_hosting.py for the fallback contract
- regenerate openapi/ (Jinja paths gone) and frontend schema.d.ts

tests/test_api_config.py

@@ -2,7 +2,6 @@
    Tests for M2-T05: POST /api/config/smtp/test."""
 from __future__ import annotations
 
-import re
 import sqlite3
 from unittest.mock import patch
 
@@ -17,26 +16,13 @@ from app.services.email import EmailConfigurationError, EmailDeliveryError
 # Helpers
 # ---------------------------------------------------------------------------
 
-def _extract_csrf_token(html: str) -> str:
-    match = re.search(r'name="csrf_token" value="([^"]+)"', html)
-    assert match is not None, "csrf_token not found in HTML"
-    return match.group(1)
-
-
 def _login(client: TestClient) -> None:
-    """Log in as admin/test-password using the Jinja login form."""
-    login_page = client.get("/login")
-    csrf_token = _extract_csrf_token(login_page.text)
+    """Log in as admin/test-password using the JSON API."""
     resp = client.post(
-        "/login",
-        data={
-            "username": "admin",
-            "password": "test-password",
-            "csrf_token": csrf_token,
-        },
-        follow_redirects=False,
+        "/api/auth/login",
+        json={"username": "admin", "password": "test-password"},
     )
-    assert resp.status_code == 303, f"Login failed: {resp.status_code}"
+    assert resp.status_code == 200, f"Login failed: {resp.status_code}"
 
 
 def _stringify(value) -> str: