feat(server): serve embedded SPA at root with /api,/rest carve-out

- NotFound wrapper routes unknown /api/* and /rest/* to a JSON 404
- Everything else falls through to the embedded web handler, which
  resolves static assets or returns index.html for SPA deep links

internal/server/server.go

@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"log/slog"
 	"net/http"
+	"strings"
 
 	"github.com/go-chi/chi/v5"
 	"github.com/go-chi/chi/v5/middleware"
@@ -14,6 +15,7 @@ import (
 	"git.fabledsword.com/bvandeusen/minstrel/internal/auth"
 	"git.fabledsword.com/bvandeusen/minstrel/internal/library"
 	"git.fabledsword.com/bvandeusen/minstrel/internal/subsonic"
+	"git.fabledsword.com/bvandeusen/minstrel/web"
 )
 
 // ScanTrigger is the subset of the scanner the HTTP handler needs. Kept as an
@@ -50,6 +52,18 @@ func (s *Server) Router() http.Handler {
 		})
 		subsonic.Mount(r, s.Pool, s.Logger, s.SubsonicCfg)
 	}
+
+	spa := web.Handler()
+	r.NotFound(func(w http.ResponseWriter, req *http.Request) {
+		p := req.URL.Path
+		if strings.HasPrefix(p, "/api/") || strings.HasPrefix(p, "/rest/") {
+			w.Header().Set("Content-Type", "application/json")
+			w.WriteHeader(http.StatusNotFound)
+			_, _ = w.Write([]byte(`{"error":{"code":"not_found","message":"not found"}}`))
+			return
+		}
+		spa.ServeHTTP(w, req)
+	})
 	return r
 }