feat(api): spaces routes

Add lib/api/routes/spaces.js: list, create, get-by-id, get-by-slug,
patch, delete. Mounted under /api/spaces. Server smoke restored.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

tests/server.test.js

@@ -25,6 +25,14 @@ describe('server', () => {
     expect(res.status).toBe(401);
   });
 
+  it('GET /api/spaces with token returns 200 and empty array', async () => {
+    const res = await request(app)
+      .get('/api/spaces')
+      .set('Authorization', 'Bearer test-token');
+    expect(res.status).toBe(200);
+    expect(res.body).toEqual([]);
+  });
+
   it('unknown /api route returns 404 with structured error', async () => {
     const res = await request(app).get('/api/nope').set('Authorization', 'Bearer test-token');
     expect(res.status).toBe(404);