M2-T11: serve React SPA from FastAPI and remove Jinja pages

- app/main.py serves the SPA build (SPA_DIST_DIR, default frontend/dist):
  mounts /assets and a GET catch-all returning index.html for client routes;
  catch-all 404s on /api/*, never swallows /docs, /openapi.json, /static, assets,
  ingestion/ticktick/status; skips SPA serving when dist absent (backend-only CI)
- delete app/api/routes/pages.py, app/api/routes/auth.py, app/templates/
  (all replaced by /api/* + SPA; auth service layer kept)
- remove/replace Jinja page tests (JSON coverage already in test_api_*);
  add tests/test_spa_hosting.py for the fallback contract
- regenerate openapi/ (Jinja paths gone) and frontend schema.d.ts

tests/test_ticktick.py

@@ -49,14 +49,6 @@ def _configured_settings(**overrides) -> Settings:
     return Settings(_env_file=None, **payload)
 
 
-def _extract_csrf_token(html: str) -> str:
-    import re
-
-    match = re.search(r'name="csrf_token" value="([^"]+)"', html)
-    assert match is not None
-    return match.group(1)
-
-
 def test_build_authorization_url_contains_expected_query(monkeypatch: pytest.MonkeyPatch) -> None:
     client = TickTickClient(settings=_configured_settings())
     monkeypatch.setattr("app.integrations.ticktick.secrets.token_hex", lambda _: "state-123")
@@ -263,17 +255,11 @@ def test_ticktick_auth_start_redirects_authenticated_user(
     monkeypatch.setattr("app.integrations.ticktick.secrets.token_hex", lambda _: "state-redirect")
 
     with TestClient(create_app()) as client:
-        login_page = client.get("/login")
-        csrf_token = _extract_csrf_token(login_page.text)
-        client.post(
-            "/login",
-            data={
-                "username": "admin",
-                "password": "test-password",
-                "csrf_token": csrf_token,
-            },
-            follow_redirects=False,
+        resp = client.post(
+            "/api/auth/login",
+            json={"username": "admin", "password": "test-password"},
         )
+        assert resp.status_code == 200, f"API login failed: {resp.status_code}"
 
         response = client.get("/ticktick/auth/start", follow_redirects=False)