fix(auth): align server.ts SPA-path check with auth-service.ts prefixes

Address claude-review nit on PR #442: the isApiOrProxyPath check used
different prefix matching than AuthService's own /v1, /messages
classification (trailing-slash-required vs not), so a bare GET /v1
request would have been swallowed by the dashboard SPA fallback instead
of falling through to the authenticated router/proxy path. Not a
security issue (dashboard shell is public either way), but the two
classifications should not drift apart.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>