Run Ankimo API outside protected Downloads

[Clearner1]

What changed

• copy the three dependency-free API runtime files into ~/Library/Application Support/Ankimo/runtime
• launch Node from that runtime directory instead of the macOS privacy-protected Downloads checkout
• refresh the runtime files before every automatic API restart

Root cause

Under launchd, Node blocked while opening TypeScript from Downloads even though the same command worked interactively. A process sample confirmed it never reached the API listener.

Evidence

• a LaunchAgent using the Application Support runtime listens on 127.0.0.1:8787
• /health returns 200
• npm run check: 32 tests, ESLint, TypeScript, Knip, Vite build
• bash -n deployment scripts
• no E2E and no real card creation