M2-T11: serve React SPA from FastAPI and remove Jinja pages

- app/main.py serves the SPA build (SPA_DIST_DIR, default frontend/dist):
  mounts /assets and a GET catch-all returning index.html for client routes;
  catch-all 404s on /api/*, never swallows /docs, /openapi.json, /static, assets,
  ingestion/ticktick/status; skips SPA serving when dist absent (backend-only CI)
- delete app/api/routes/pages.py, app/api/routes/auth.py, app/templates/
  (all replaced by /api/* + SPA; auth service layer kept)
- remove/replace Jinja page tests (JSON coverage already in test_api_*);
  add tests/test_spa_hosting.py for the fallback contract
- regenerate openapi/ (Jinja paths gone) and frontend schema.d.ts

tests/test_public_ip.py

@@ -1,5 +1,4 @@
 from datetime import UTC, datetime
-import re
 import sqlite3
 
 from fastapi.testclient import TestClient
@@ -17,25 +16,12 @@ def _make_session(database_url: str) -> Session:
     return session_local()
 
 
-def _extract_csrf_token(html: str) -> str:
-    match = re.search(r'name="csrf_token" value="([^"]+)"', html)
-    assert match is not None
-    return match.group(1)
-
-
 def _login(client: TestClient) -> None:
-    login_page = client.get("/login")
-    csrf_token = _extract_csrf_token(login_page.text)
     response = client.post(
-        "/login",
-        data={
-            "username": "admin",
-            "password": "test-password",
-            "csrf_token": csrf_token,
-        },
-        follow_redirects=False,
+        "/api/auth/login",
+        json={"username": "admin", "password": "test-password"},
     )
-    assert response.status_code == 303
+    assert response.status_code == 200
 
 
 def test_public_ip_first_seen_persists_state_and_history(auth_database) -> None: