feat: HTTP API server with SSE and SPA serving (HAN-389)

- web/api/server.go: HTTP server with CORS middleware, graceful shutdown,
  configurable listen address via NewServer(addr); uses net.Listen so the
  bound port is available via Addr() for tests.

- web/api/handler.go: REST handlers over Go 1.22 mux patterns:
    POST /api/traverse        start async traversal -> {id, status}
    GET  /api/traverse/{id}   poll status + results
    GET  /api/traverse/{id}/stream  SSE live progress events
    GET  /api/health          health check
  In-memory job store with 1-hour TTL and background cleanup goroutine.
  Background traversal via traverse.Traverser with hook-driven progress
  events fanned out to SSE subscribers.

- web/api/static/index.html: placeholder SPA shell (embedded via
  //go:embed static). Unknown URL paths fall back to index.html for
  client-side routing.

- cmd/server/main.go: runnable server binary with -addr flag and
  SIGINT/SIGTERM graceful shutdown.

All tests pass: go test -race ./...  |  go vet ./...

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: multica-agent <github@multica.ai>

web/api/static/index.html

@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>ExploreDNS</title>
+</head>
+<body>
+  <h1>ExploreDNS</h1>
+  <p>Frontend coming soon.</p>
+</body>
+</html>