feat: remove public REST API; route all app calls over WebSocket RPC

The platform no longer exposes a public /api/* REST surface. The original
HTTP route handlers are preserved verbatim as the single source of truth
inside an internal, never-socket-bound FastAPI app (rpc_app), and are now
reached only via RPC-over-WebSocket dispatch.

- realtime router: anonymous connections allowed only to /api/auth/login
  and /api/auth/signup; all other RPCs/subscribes refused until token auth.
- RPC dispatch re-injects the bearer token and X-Request-ID, then forwards
  through httpx.ASGITransport against the internal app (no network hop).
- Public app now serves only /, /health, /health/ready and /api/ws;
  docs/openapi disabled.
- Frontend: apiRequest routes /api/* to ws.rpc(); /health probes keep fetch.
  RealtimeClient gains rpc() with id correlation, timeout and AbortSignal.
- Tests repointed to get_rpc_app(); anonymous-auth behaviour covered.

Result: zero REST on the public surface; 264 backend tests + frontend
typecheck pass.

apps/api/tests/conftest.py

@@ -24,7 +24,11 @@ from app.core.config import settings
 from app.core.database import Base, get_session
 from app.domain.base import new_id
 from app.infrastructure.db.models import UserRow
-from app.main import app
+# The internal "full" app holds every HTTP handler; the public app (app.main.app)
+# now serves only /health + /api/ws, so REST tests must target the full app.
+from app.interfaces.realtime.rpc_app import get_rpc_app
+
+app = get_rpc_app()
 
 
 @pytest.fixture(scope="session", autouse=True)