server: RFC7807 404s without a client build; document STATS_PUBLIC

Two of the three items from #54 (item 1, the dead is_return column, is
a drop-or-use product call left for mara — see issue comment):

1. The RFC7807 404 handler for /api and /admin/api was only registered
   inside the 'if (existsSync(clientDist))' branch, so a server-only
   deploy (or any run before 'pnpm --filter client build') fell through
   to Fastify's default 404 shape instead — quietly opting API routes
   out of the one-error-shape guarantee the RFC7807 conversion was for.
   Split registration from the static-file serving: the not-found
   handler (and its API-vs-SPA-fallback branching) is now unconditional,
   only the SPA html sendFile calls stay gated on hasClientDist.
2. STATS_PUBLIC added to the README's env-var list (was only in
   deploy/wutzcalc.env.example) — an operator wanting the infopoint-
   screen setup wouldn't find the switch, and an operator auditing
   "what can expose data here" from the README wouldn't see it exists.

Verified live: renamed client/dist away and confirmed /api, /admin/api,
and a bare unmatched route all return RFC7807 problem+json (no crash);
restored it and confirmed the SPA fallback (admin.html/stats.html/
index.html) still serves correctly. tsc --noEmit and server build both
clean.

README.md

@@ -170,3 +170,7 @@ the service user owns the database directory automatically.
 - `WUTZ_SERVER_PORT` (default `3000`, **client dev only** — not read by the server) — the port
   `dev:client`'s Vite proxy targets; set it to match `dev:server`'s `PORT` when running the server
   on something other than the default
+- `STATS_PUBLIC` (default off, set to `1` to enable) — makes `/stats` viewable without the admin
+  login normally required (e.g. a screen permanently mounted at a festival infopoint). Doesn't
+  affect `/admin` itself, or the "Statistik zurücksetzen" reset button, which stays gated on a real
+  admin session either way.