API: also serve routes under /api

A reverse proxy can now forward /api/ to the API with or without stripping
the prefix (NPMplus custom locations don't strip it).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MzFywujuH9TiuXbr9vjoX8

apps/api/src/app.ts

@@ -22,7 +22,15 @@ import { webhookRoutes } from './routes/webhooks';
 
 /** Builds the API without listening, so tests can drive it with app.inject(). */
 export async function buildApp({ logger = true, rateLimits = true }: { logger?: boolean; rateLimits?: boolean } = {}) {
-  const app = Fastify({ logger, trustProxy: true });
+  const app = Fastify({
+    logger,
+    trustProxy: true,
+    // Serve /api/... as well as /..., so a reverse proxy can forward /api/ with or without stripping it.
+    rewriteUrl: (req) => {
+      const url = req.url ?? '/';
+      return url === '/api' || url.startsWith('/api/') || url.startsWith('/api?') ? url.slice(4) || '/' : url;
+    },
+  });
 
   await app.register(cors, {
     origin: [env.WEB_URL],