fix: add missing /groups serve.json rewrite causing direct-nav 404

[michaelrobertsutton]

Summary

• Add the missing /groups rewrite to frontend/public/serve.json. serve runs deliberately without -s (see b8a3808), so every client-side route needs an explicit rewrite entry; PR feat: experimental Groups $evaluate page (#322) #326 added the /groups route and nav link but never added the matching rewrite, so a refresh, bookmark, or shared link to /groups hard-404s in production while client-side nav works fine.
• Add frontend/src/App.routes.test.js: a parity guard asserting every <Route> path in App.js has a matching serve.json rewrite and vice versa. Fails loud (route-tag count must equal extracted-path count, minimum 8 routes) so an unparseable route shape fails the test instead of silently narrowing the guard, rather than a general react-router/serve-handler equivalence claim.
• Wire npm test into the Frontend Build CI job (previously npm ci && npm run build only — none of the 6 pre-existing frontend test files, or this new one, ever ran in CI). Confirmed all 7 suites (92 tests) pass locally before adding this step.

Related issue

Closes #383

Type of change

• Bug fix
• New feature
• Refactor / cleanup
• Documentation
• Infrastructure / CI/CD
• Chore (deps, tooling, lockfile)

Checklist

• Tests added or updated
• docs/ updated (if architecture or API changed) — N/A, no architecture change
• No new ADRs needed
• Security implications considered — N/A, static rewrite config + test/CI change only

Test plan

• cd frontend && npm ci && CI=true npm test -- --watchAll=false — 7 suites, 92 tests, all green
• Proved the new guard is meaningful: reverted only the serve.json line, reran, confirmed App.routes.test.js fails with the exact missing-path diff, restored the fix, confirmed green again
• docker compose up -d --build (full stack per .env.example), then:
  • curl http://localhost:3001/groups → 200 text/html (was 404)
  • Swept every route (/, /measures, /jobs, /groups, /groups/, /results, /results/:jobId, /validation, /settings) plus /groups?x=1 → all 200 text/html
  • Confirmed b8a3808's intent preserved: http://localhost:3001/nope.png still returns a real 404 (not a silently-swallowed 200 app-shell fallback), manifest.json and the built JS bundle still serve correctly
• Browser check via headless Chromium: fresh navigation to /groups loads the app shell with no console errors; enabled the groups_enabled admin toggle in Settings, clicked "Groups" in the sidebar nav, then hard-refreshed on /groups — the exact user path that was 404ing before this fix — loads correctly, no console errors

Follow-up filed separately (not in this PR): #384 tracks collapsing App.js's 5-way route-path duplication (<Route> JSX, ALL_NAV_ITEMS, PAGE_TITLE, SEARCH_PLACEHOLDER, serve.json) into one shared ROUTES constant.