fix: serve SvelteKit _app assets correctly

- Use all: prefix in go:embed to include _app/ directory (Go skips
  _-prefixed dirs by default)
- Move jsonContentType middleware to /api route group only
- Use http.ServeContent for proper MIME type detection
- Remove unused fileServer variable

internal/api/router.go

@@ -88,9 +88,11 @@ func (s *Server) Router() chi.Router {
 	r.Use(recovery)
 	r.Use(logging)
 	r.Use(cors)
-	r.Use(jsonContentType)
 
 	r.Route("/api", func(r chi.Router) {
+		// JSON content type only for API routes (not static files).
+		r.Use(jsonContentType)
+
 		// Public auth endpoints (no auth required).
 		r.Post("/auth/login", s.login)
 		r.Get("/auth/oidc/login", s.oidcLogin)