fix: 修复 SPA fallback 路径匹配，/api-tester 不再被误拦截

- startsWith('/api') 改为 startsWith('/api/')，避免前端路由 /api-tester 被跳过
- 修正 webDir 解析路径，指向 dist/web 而非源码 web/

src/server/app.ts

@@ -300,9 +300,9 @@ export class AppServer {
 
   private setupWebDashboard(): void {
     // Resolve the web dashboard dist directory relative to this file.
-    // In the built output: dist/server/app.js → dist/web/ is at ../web
+    // tsup bundles to dist/index.js, so dist/web/ is a sibling.
     const thisDir = path.dirname(fileURLToPath(import.meta.url));
-    const webDir = path.resolve(thisDir, '..', 'web');
+    const webDir = path.resolve(thisDir, 'web');
 
     if (!fs.existsSync(webDir)) {
       logger.debug({ webDir }, 'Web dashboard dist not found, skipping static mount');
@@ -319,7 +319,7 @@ export class AppServer {
     this.app.get('*', (req, res, next) => {
       // Skip API / MCP / health routes
       if (
-        req.path.startsWith('/api') ||
+        req.path.startsWith('/api/') ||
         req.path.startsWith('/sse') ||
         req.path.startsWith('/messages') ||
         req.path === '/health'