fix: replace settings redirect with API key prompt modal

[CJFWeatherhead]

Summary

Replace the onMount redirect to /settings with a modal overlay that prompts for API credentials on whichever page the user is visiting. This fixes several broken standard browser behaviours.

Problems fixed

• Refresh loses the page — the old goto(base + "/settings") ran on every page load when credentials had not been validated yet, so any refresh redirected to Settings
• Back button loops — navigating back just triggered another redirect to Settings
• Direct URL access fails — visiting e.g. /nodes directly showed a blank page briefly before redirecting, because the SPA had no fallback for unknown paths
• First-time flow is confusing — new users were dumped on the Settings page with no clear indication of what to do

Changes

File	Change
src/lib/parts/ApiKeyPrompt.svelte	New — modal overlay prompting for API URL + key when !App.hasApi. Validates credentials with a direct fetch before persisting them.
src/routes/+layout.svelte	Removed goto(settings) redirect and its imports. Added ApiKeyPrompt component.
svelte.config.js	Added fallback: "200.html" to adapter-static so unknown paths get a usable SPA shell instead of a 404.
Caddyfile	Extended try_files with {path}/index.html and /200.html fallback for robust serving of pre-rendered routes and SPA fallback.
src/index.test.ts	Replaced the placeholder 1+2=3 test with 32 unit tests covering funcs.ts utilities.
.github/workflows/ci.yml	New — CI pipeline: lint + type-check, unit tests, static build (with and without ENDPOINT), Docker build smoke test.
README.md	Added Authentication Flow section describing the new behaviour.

Behaviour after this change

1. First visit (no credentials) — API key prompt modal appears over the requested page. Enter credentials, modal validates and dismisses, you remain on the page you originally requested.
2. Returning user — page loads directly, no prompt, no redirect.
3. Refresh — works on any page (each route has pre-rendered HTML; JS hydrates and polls data).
4. Back button — works normally (no redirect loop).
5. Settings page — fully functional for changing credentials, theme, TTL, debug settings.
6. Invalid key mid-session — existing toast notification; user navigates to Settings manually.

Testing

• 32 unit tests (all passing via vitest run)
• svelte-check — 0 errors, 0 warnings
• Static build verified with both ENDPOINT="" and ENDPOINT=/admin
• All pre-rendered routes + 200.html fallback confirmed in build output