fix: category cache refresh, API 404, redundancy mapping, cost/relation authz, voterToken exposure

- Invalidate categories/features queries after creating/editing tools so new
  categories appear immediately in search, browse dropdown and tool form
- Always refetch categories/features when the combobox/suggestion inputs mount
- Return JSON 404 for unmatched /api routes instead of the SPA index.html
- Read the manually confirmed 'better tool' from the recommendation notes
  instead of using the min tool id in the redundancy dashboard
- Require admin for cost/relation update+delete endpoints
- Stop exposing the voter token in the ratings list response
- Fix parseInt type error on user id params (Express 5 params typing)

artifacts/api-server/src/app.ts

@@ -60,6 +60,12 @@ app.use(
 
 app.use("/api", router);
 
+// Any unmatched /api route should return a JSON 404 instead of falling
+// through to the SPA catch-all below.
+app.use("/api", (_req, res) => {
+  res.status(404).json({ error: "Not found" });
+});
+
 const staticDir = process.env.STATIC_DIR;
 if (staticDir && existsSync(staticDir)) {
   app.use(express.static(staticDir));