dashboard: fix matrix-accounts GET path to /api/matrix-accounts

BE-1 (the list endpoint) lives at GET /api/matrix-accounts (reads go under
/api/, matching /api/state and /api/operator-inbox); the page was calling
the un-prefixed /matrix-accounts. Correct the fetch + the contract comment +
the docs reference. POST /matrix-account-login (mutation, root path like
/approve) is unchanged.

docs/web-ui/dashboard.md

@@ -212,7 +212,7 @@ purpose-built endpoints.
 
 An agent picker (populated from `state.agents`) drives a list of that
 agent's configured accounts — name, homeserver, and a token-status dot —
-read from `GET /matrix-accounts?agent=<name>` →
+read from `GET /api/matrix-accounts?agent=<name>` →
 `{ accounts: [ { name, homeserver, token_present } ] }`. The status
 reflects only whether a token is **stored** (labelled "token stored",
 not "online"); a true live up/down indicator needs the matrix daemon's

frontend/packages/dashboard/src/matrix-accounts.js

@@ -5,7 +5,7 @@
 // repo. Companion to the multi-account harness support.
 //
 // Backend contract (v1):
-//   GET  /matrix-accounts?agent=<name>
+//   GET  /api/matrix-accounts?agent=<name>
 //        -> { accounts: [ { name, homeserver, token_present: bool } ] }
 //   POST /matrix-account-login        (x-www-form-urlencoded, operator-auth)
 //        fields: agent, account, homeserver, mode=password|token,
@@ -62,7 +62,7 @@ async function loadAccounts(agent) {
   list.replaceChildren(el('p', { class: 'meta' }, 'loading…'));
   let data;
   try {
-    const resp = await fetch('/matrix-accounts?agent=' + encodeURIComponent(agent));
+    const resp = await fetch('/api/matrix-accounts?agent=' + encodeURIComponent(agent));
     if (!resp.ok) throw new Error('HTTP ' + resp.status);
     data = await resp.json();
   } catch (err) {