Follow-ups to #266: pin the shadow guard's bare-/api arm and self-dispatch guard, rename stale test, fix API-only banner #281

Follow-ups from the round-2 re-review of #266 (#233, merged as 81b13b20). Details are in the review comment on #266.

1. N1 — the bare-/api arm of the shadow guard is not pinned. If tmpl == "/api" is dropped from apiRoutesShadowedByFallback, the suite stays green (mutant D). Add a test.
2. N2 — the self-dispatch guard in getRouteHandler is not pinned. This is the guard where GetMethods() errors, the matched route is the fallback itself, and the result is nil. Removing it leaves the suite green (mutant L). Add a test.
3. N3 — TestPostPacketsRemovedFallsThroughToSPAInProductionRouter now asserts 405 + Allow. Rename it to match.
4. N4 — the API-only banner in cmd/server/main.go (~662) still says "API available at /api/". That path is now a JSON 404. Point it to an existing endpoint such as /api/docs or /api/spec.