feat: extract @libscope/server — REST API and web dashboard

[RobertLD]

Summary

Part of #488. Extract src/api/ and src/web/ into a standalone @libscope/server package, isolating HTTP server concerns (middleware, auth, CORS, rate limiting) from the core library.

Problem / Motivation

Servers have process lifecycle concerns (listen/close), authentication middleware, HTTP framework dependencies, and a web dashboard — none of which are relevant to library consumers. Today they're accessible via src/core/index.ts re-exports, polluting the core public surface.

Proposed Solution

Move src/api/ and src/web/ into packages/server/ with its own package.json. The package depends on @libscope/core for all data access.

Acceptance Criteria

• @libscope/server builds independently, depending on @libscope/core for data access
• The REST API server starts correctly and all routes function as expected
• The web dashboard (graph visualization, statistics) loads correctly
• src/core/index.ts no longer re-exports src/api/server.ts or src/web/server.ts
• Existing CLI libscope serve command works correctly after the move

Out of Scope

• Changes to the REST API routes or OpenAPI spec
• Changes to the web dashboard UI

Technical Notes

• src/api/ contains: server.ts, routes.ts, middleware, OpenAPI spec
• src/web/ contains: server.ts, dashboard.ts (one giant template literal — do not modify), graph-api.ts
• Note: src/web/dashboard.ts contains intentional escape sequences and must not be reformatted