fix: SPA fallback returns 200 instead of 404 for client-side routes

ServeDir::not_found_service serves index.html but preserves the 404
status code. Switch to ServeDir::fallback which returns 200, fixing
client-side routes like /login returning 404 to the browser.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backend/src/router.rs

@@ -100,7 +100,7 @@ pub fn build_router(state: AppState, config: &AppConfig) -> Router {
     let index_file = format!("{}/index.html", static_dir);
 
     let spa_fallback =
-        ServeDir::new(&static_dir).not_found_service(ServeFile::new(&index_file));
+        ServeDir::new(&static_dir).fallback(ServeFile::new(&index_file));
 
     // Build the full application with state
     let mut app = Router::new()