fix: category cache refresh, API 404, redundancy mapping, cost/relation authz, voterToken exposure

- Invalidate categories/features queries after creating/editing tools so new
  categories appear immediately in search, browse dropdown and tool form
- Always refetch categories/features when the combobox/suggestion inputs mount
- Return JSON 404 for unmatched /api routes instead of the SPA index.html
- Read the manually confirmed 'better tool' from the recommendation notes
  instead of using the min tool id in the redundancy dashboard
- Require admin for cost/relation update+delete endpoints
- Stop exposing the voter token in the ratings list response
- Fix parseInt type error on user id params (Express 5 params typing)

artifacts/toolrate/src/components/feature-input.tsx

@@ -1,6 +1,6 @@
 import { useState, useRef, useEffect } from "react";
 import { Input } from "@/components/ui/input";
-import { useListAllFeatures } from "@workspace/api-client-react";
+import { useListAllFeatures, getListAllFeaturesQueryKey } from "@workspace/api-client-react";
 import { cn } from "@/lib/utils";
 
 interface FeatureInputProps {
@@ -13,7 +13,13 @@ interface FeatureInputProps {
 export function FeatureInput({ value, onChange, placeholder, "data-testid": testId }: FeatureInputProps) {
   const [open, setOpen] = useState(false);
   const containerRef = useRef<HTMLDivElement>(null);
-  const allFeatures = useListAllFeatures();
+  const allFeatures = useListAllFeatures({
+    query: {
+      queryKey: getListAllFeaturesQueryKey(),
+      refetchOnMount: "always",
+      staleTime: 0,
+    },
+  });
 
   const known: string[] = allFeatures.data ?? [];