API: also serve routes under /api

A reverse proxy can now forward /api/ to the API with or without stripping
the prefix (NPMplus custom locations don't strip it).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MzFywujuH9TiuXbr9vjoX8

apps/api/test/auth.test.ts

@@ -26,6 +26,18 @@ describe('auth', () => {
     expect(viaCookie.json().id).toBe(user.id);
   });
 
+  it('serves the same routes under /api for proxies that keep the prefix', async () => {
+    const res = await app().inject({
+      method: 'POST',
+      url: '/api/auth/register',
+      payload: { username: 'bob', email: 'bob@example.com', password: 'password123' },
+    });
+    expect(res.statusCode).toBe(200);
+    const me = await app().inject({ url: '/api/me?x=1', headers: bearer(res.json().token) });
+    expect(me.json().username).toBe('bob');
+    expect((await app().inject({ url: '/apiary' })).statusCode).toBe(404);
+  });
+
   it('stores only a hash of the session token', async () => {
     const { token } = await createUser(app(), 'alice');
     const rows = await sql`select id from sessions`;