Extract @codra/api, the HTTP surface as a mountable router

[devarshishimpi]

Why

The HTTP layer in src/server/app.ts, src/server/routes and src/server/middleware is currently the Worker: it constructs the Hono app, reads bindings off the context, and calls DB modules and GitHub helpers inline. There is no way to mount the API in another host, and route handlers do orchestration work that belongs in packages/core.

Scope

• Move the routing layer to packages/api/src as a factory: createApiRouter(deps) returns a Hono router given ports (repositories, git provider, model runner, session store, platform).
• Move src/server/routes/api/*, src/server/routes/auth.ts and src/server/routes/webhook.ts into packages/api/src/routes. Handlers become thin: validate with packages/schema, call a packages/core use case, serialize the result. No SQL, no provider SDK calls, no binding access in a handler.
• Move src/server/middleware/auth.ts, csrf.ts and observability.ts into packages/api/src/middleware, parameterized to take ports rather than reading c.env directly.
• Finish the webhook split started in the git-provider issue: signature verification and payload normalization live in packages/provider-github, the route in packages/api only dispatches.
• Keep the response contracts in packages/schema authoritative so apps/dashboard is unaffected.

Acceptance criteria

• The router can be mounted in a plain Node host with in-memory ports; test/api runs against it without Miniflare.
• No route handler imports from packages/db or from a provider package directly, only through the injected ports.
• Every existing endpoint keeps its path, status codes and response shape; test/e2e passes untouched.
• apps/worker is reduced to binding wiring plus a call to createApiRouter.