fix: global JSON 404/error handlers + docs sync

[Pyronewbic]

Summary

• Add global JSON 404 catch-all and error handler to api.js — fixes ZAP DAST findings (500s on cloud metadata probes, HTML Content-Type on unmatched routes)
• Update docs/internals.md lib/ tree to match actual auth/ + cards/ split
• Fix test counts across README and internals (266 unit / 97 API / 71 smoke = 434 total)
• Add missing env vars to docs/env-vars.md: CASECOMP_JWT_SECRET, CASECOMP_ADMIN_SUB, TOGETHER_API_KEY, fix GOOGLE_OAUTH_CLIENT_ID description
• Fix Binary Authorization from "audit mode" to "enforced" in README
• Remove stale v1/drops curl example from README

Test plan

• Deploy and re-run ZAP DAST — verify 0 Medium, 0 Low findings (CORS wildcard remains accepted risk)
• Verify unmatched routes return {"error":"Not found"} with Content-Type: application/json
• Verify unhandled errors return sanitized JSON, not HTML stack traces