fix: category cache refresh, API 404, redundancy mapping, cost/relation authz, voterToken exposure

- Invalidate categories/features queries after creating/editing tools so new
  categories appear immediately in search, browse dropdown and tool form
- Always refetch categories/features when the combobox/suggestion inputs mount
- Return JSON 404 for unmatched /api routes instead of the SPA index.html
- Read the manually confirmed 'better tool' from the recommendation notes
  instead of using the min tool id in the redundancy dashboard
- Require admin for cost/relation update+delete endpoints
- Stop exposing the voter token in the ratings list response
- Fix parseInt type error on user id params (Express 5 params typing)

artifacts/api-server/src/routes/users.ts

@@ -73,7 +73,7 @@ router.post("/users", requireAdmin, async (req, res): Promise<void> => {
 });
 
 router.patch("/users/:id", requireAdmin, async (req, res): Promise<void> => {
-  const id = parseInt(req.params.id, 10);
+  const id = parseInt(String(req.params.id), 10);
   if (isNaN(id)) {
     res.status(400).json({ error: "Invalid user id" });
     return;
@@ -107,7 +107,7 @@ router.patch("/users/:id", requireAdmin, async (req, res): Promise<void> => {
 });
 
 router.delete("/users/:id", requireAdmin, async (req, res): Promise<void> => {
-  const id = parseInt(req.params.id, 10);
+  const id = parseInt(String(req.params.id), 10);
   if (isNaN(id)) {
     res.status(400).json({ error: "Invalid user id" });
     return;