dashboard: point frontend at the /api/* backend routes

Phase 2 of the dashboard route consolidation. The backend now double-registers
every bare top-level route (approve/deny/kill/restart/start/rebuild/destroy/
update-all/answer-question/cancel-question/purge-tombstone/matrix-account-login/
cancel-reminder/retry-reminder/request-spawn/op-send/meta-update/dashboard-stream/
dashboard-history) at an additional /api/<same> path. Switch every dashboard-pkg
fetch / EventSource / form action to the /api/ form so "backend = /api/*" holds
on the frontend side too.

Bare paths still answer, so this is independently deployable; once it ships the
backend can drop the bare registrations (phase 3). webhook/knowledge stays a
distinct webhook prefix (forge-driven, no SPA caller). app.js's /rebuild,/start
are the agent harness UI (different server) and are untouched.

Part of #1846 (phase 2).

frontend/packages/dashboard/src/core.html

@@ -48,7 +48,7 @@
 
     <!-- R3BU1LD QU3U3: pending + running rebuilds, meta-updates, and
          first-spawns. Driven by /api/state.rebuild_queue cold-load +
-         live `rebuild_queue_changed` over /dashboard/stream. Default tab. -->
+         live `rebuild_queue_changed` over /api/dashboard/stream. Default tab. -->
     <section class="core-pane" id="core-pane-rebuild" data-tab-pane="rebuild"
              role="tabpanel" aria-labelledby="core-tab-rebuild">
       <p class="meta">pending + running rebuilds, meta-updates, and first-spawns. one runs at a time; meta-update cascades nest under their parent. dedup: re-enqueueing a still-queued op collapses into the existing entry.</p>