dashboard: point frontend at the /api/* backend routes

Phase 2 of the dashboard route consolidation. The backend now double-registers
every bare top-level route (approve/deny/kill/restart/start/rebuild/destroy/
update-all/answer-question/cancel-question/purge-tombstone/matrix-account-login/
cancel-reminder/retry-reminder/request-spawn/op-send/meta-update/dashboard-stream/
dashboard-history) at an additional /api/<same> path. Switch every dashboard-pkg
fetch / EventSource / form action to the /api/ form so "backend = /api/*" holds
on the frontend side too.

Bare paths still answer, so this is independently deployable; once it ships the
backend can drop the bare registrations (phase 3). webhook/knowledge stays a
distinct webhook prefix (forge-driven, no SPA caller). app.js's /rebuild,/start
are the agent harness UI (different server) and are untouched.

Part of #1846 (phase 2).

frontend/packages/dashboard/src/stream-worker.js

@@ -2,7 +2,7 @@
 // every server-sent event out to every connected tab via MessagePort.
 //
 // Problem this solves: every dashboard / agent tab opens its own
-// `EventSource('/dashboard/stream')`. Browsers cap concurrent
+// `EventSource('/api/dashboard/stream')`. Browsers cap concurrent
 // connections per host (~6), and Firefox throttles / disconnects
 // background tabs when many are open. The result: tabs silently
 // drop the SSE, fall behind, and only catch up on focus.
@@ -15,8 +15,8 @@
 // Wire protocol (port.postMessage payloads):
 //
 //   tab → worker
-//     { kind: 'subscribe',   url: '/dashboard/stream' }
-//     { kind: 'unsubscribe', url: '/dashboard/stream' }
+//     { kind: 'subscribe',   url: '/api/dashboard/stream' }
+//     { kind: 'unsubscribe', url: '/api/dashboard/stream' }
 //
 //   worker → tab
 //     { kind: 'open',    url: '...' }   relayed from EventSource.onopen,