fix: return 404 for unmatched API routes instead of SPA fallback

MapFallback was catching all unmatched routes including /api/* paths,
returning 200 OK with index.html. This caused the CI test
Parse_EndpointRemoved_ReturnsErrorStatus to fail because the removed
/api/v1/import/parse endpoint returned 200 instead of 404.

Added a guard to return 404 for requests starting with /api/ so
API consumers get proper error responses while SPA routing still
works for all other paths.

Author: Fortinbra

src/BudgetExperiment.Api/Program.cs

@@ -214,9 +214,16 @@ await context.Response.WriteAsJsonAsync(new
 
         // Serve index.html with embedded client config to eliminate startup fetch round-trip.
         // Config JSON is injected once at startup and cached for the lifetime of the process.
+        // Only applies to non-API paths so unmatched API routes return proper 404s.
         var configInjectedHtml = BuildConfigInjectedIndexHtml(app);
         app.MapFallback(async context =>
         {
+            if (context.Request.Path.StartsWithSegments("/api", StringComparison.OrdinalIgnoreCase))
+            {
+                context.Response.StatusCode = StatusCodes.Status404NotFound;
+                return;
+            }
+
             context.Response.ContentType = "text/html; charset=utf-8";
             context.Response.Headers.CacheControl = "no-cache";
             await context.Response.WriteAsync(configInjectedHtml);