Separate the API pipeline from the UI pipeline

[elgorro]

Found while standing up the API test tier (#37, PR #38).

Program.cs runs one middleware pipeline for both the Blazor UI and the minimal API under /api,
and the two want different behaviour. Concretely: UseStatusCodePagesWithReExecute("/not-found")
re-executes with the original request method, so an unauthorized POST /api/matches was re-run
against a Razor component and answered 400 "The request has an incorrect Content-type." instead
of 401. An API client would have seen a wrong status with no way to tell why.

PR #38 patches the symptom by scoping the re-execution to non-/api paths. The shape of the problem
is more general — the same pipeline also applies HTML-oriented exception handling, HSTS and
antiforgery to JSON requests — so it is worth separating properly rather than adding another
UseWhen each time this bites.

• Branch the pipeline once: /api gets JSON problem-details error handling and no status-code
  re-execution; everything else keeps the UI behaviour
• Return RFC 9457 ProblemDetails from the API on 4xx/5xx (AddProblemDetails)
• Cover in Ssabba.Web.Tests: unauthorized write is 401, unknown /api route is 404, and
  neither is rewritten into an HTML response
• Check the same for the antiforgery middleware, which currently sits ahead of authentication