[Bug] Unknown API routes should return JSON 404 responses

[LukastGeorge]

References #33.

/bounty $50

Summary

The Express API currently falls through to Express's default 404 handler for unknown routes. That response is HTML (text/html) instead of a JSON API response, so API clients and smoke tests cannot consistently parse errors from missing endpoints.

Impact

This is a small API correctness bug. Missing or mistyped API routes return a different response format from normal API responses, making client error handling and automated validation less predictable.

Affected area

• apps/api/src/index.ts
• focused API validation for unknown routes

Expected behavior

Unknown API routes should return HTTP 404 with an application/json response body. Existing /health and /users behavior should stay unchanged.

Acceptance criteria

• Add a JSON 404 fallback after the registered API routes.
• Preserve existing /health and /users behavior.
• Add a focused validation script or test that proves an unknown route returns status 404 with JSON content.

[LukastGeorge]

/claim #1632

Submitted PR #1633: #1633

Scope:

• unknown API routes now return HTTP 404 with a JSON response body
• existing /health and /users behavior is preserved
• added a focused validation script for status, content type, and body
• included required AI agent metadata

Validation:

• npm test -w apps/api
• npm test
• agents JSON parse check
• git diff --check

Payment: PayPal/Payoneer details can be provided privately after maintainer acceptance.