web-ui: one idiom for proxied API routes (#488)

The web-ui server's /api router hand-rolled the same three fragments in roughly fifty places: a try/catch around JSON body parsing, a core fetch plus relay, and a decodeURIComponent of a path slice. The copies had drifted — several catch blocks forgot to rethrow PayloadTooLargeError, so an oversized body on those routes answered a plain 400 instead of the 413 every other route returns. This collapses all of them onto four small helpers (readJson, relayCore, relayCap, pathId), moving the path matcher into the shared chassis package so core and plugins use one router. Behavior is identical except the drifted routes now correctly yield 413 on oversized bodies.

**Deployment notes**

Web-ui proxy refactor tightens its own HTTP contract: oversized bodies now 413 consistently,
non-object JSON bodies and empty bodies on eight strict routes now 400 — only the bundled
web-ui frontend calls these routes, so external impact is nil unless someone scripted against the
proxy
Moves the route matcher into plugins/chassis (core re-exports it), consistent with the chassis-as-
shared-plumbing rule; no persisted state

<!-- codesmith:footer -->
---
<a href="https://app.blacksmith.sh/yc-software/codesmith/qm/pr/488"><picture><source media="(prefers-color-scheme: dark)" srcset="https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-dark-v2.svg"><source media="(prefers-color-scheme: light)" srcset="https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-light-v2.svg"><img alt="View with [code]smith" src="https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-dark-v2.svg"></picture></a> <a href="https://backend.blacksmith.sh/track/enable-autofix?expires=1789249502&installation_model_id=19911&pr_number=488&repository=yc-software%2Fqm&return_to=https%3A%2F%2Fgithub.com%2Fyc-software%2Fqm%2Fpull%2F488&signature=0adddd7423f6f2b2b56bc02b9bee5d2ba1d7c74b3a44de6671ee64f8644176b1"><picture><source media="(prefers-color-scheme: dark)" srcset="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-light.svg"><img alt="Autofix with [code]smith" src="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-dark.svg"></picture></a>
<sup>Need help on this PR? Tag <code>@codesmith-bot</code> with what you need. Autofix is disabled.</sup>

<!-- codesmith:autofix:disabled -->
<!-- /codesmith:footer -->