fix(routes): canonicalize aliases and constrain compatibility

[trac3r00]

Summary

fix(routes): canonicalize aliases and constrain compatibility. This is logical change 11/11 in the dependency-ordered product-audit release stack.

Closes #969

What changed

• fix(routes): canonicalize aliases and constrain compatibility
• Exact source commit: e5c99575be2bdad4286bce4c300fea6cf3f77b17; validated tree: e18ca0944a49196ae72e6dbf332594352c4cb93a.
• Depends on the preceding release-stack PR. Retarget to main only after its dependency is merged and deployed.

Why

Keep canonical URLs and known compatibility links working while unknown paths correctly return 404.

Verification

• bun run build passed on this exact candidate tree.
• npm test -- --maxWorkers=2 passed on this exact candidate tree.
• Affected behavior manually exercised as described below.
• Latest GitHub Build, Unit Tests (Vitest), and E2E Tests (Playwright) must all pass before merge.

Tests  801 passed (801)
CANDIDATE_BUILD_UNIT_GREEN
Committed tree equals validated tree: e18ca0944a49196ae72e6dbf332594352c4cb93a

19 HTTP cases passed, including seven query-preserving HTML aliases, known/unknown compatibility paths, disabled API boundaries, health and favicon; real Korean alias navigation passed.

Final combined tree additionally passed 801 unit tests and all 293 Playwright tests with retries disabled, plus all 48 primary tool workflows at desktop and mobile. The exploratory Color Converter exact-HEX boundary remains a documented pre-existing defect; its runtime is unchanged by this stack.

Risk & rollback

• Risk: Dependent commits require earlier stack changes; merge in order.
• Rollback: revert this PR through a new PR; do not revert dependencies beneath already-merged dependents.
• Release: require an approving review and latest-SHA CI. Respect the 15-minute soak between deploy-affecting merges and verify the production deployment before continuing.

---

Summary by cubic

Canonicalizes route aliases and constrains /tools/ compatibility redirects so .html aliases point to canonical URLs and unknown /tools paths return 404 instead of being rewritten. Closes #969.

• /index.html, /about.html, /careers.html, /contact.html, /privacy.html, /security.html, and /terms.html now 301 to canonical paths, preserving query strings.
• /tools/* redirects only for registered tools, known legacy redirects, or dev-only compat redirects; unknown suffixes return 404.
• Dev-tool compatibility redirects are accepted only under development.
• Retired password-generator API endpoints (all six prefixes, subpaths, GET and POST) now return the site 404; the old disabled-API branch was unreachable dead code and was removed.

Rollout

• Merge this after the preceding release-stack PR has been merged and deployed; retarget to main only after that dependency is in.

^{Written for commit 67b078c. Summary will update on new commits.}

[cubic-dev-ai]

All reported issues were addressed across 4 files

<sub>Shadow auto-approve: would not auto-approve because issues were found.

Re-trigger cubic</sub>

[cubic-dev-ai]

0 issues found across 2 files (changes from recent commits).

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

<sub>Shadow auto-approve: would require human review. Canonicalizes HTML aliases and restricts /tools redirects, changing public URL responses, and replaces disabled-API 403s with 404s; the public-contract impact and unreachable-branch claim need human review.

Re-trigger cubic</sub>