fix: disable API v1 write methods (closes #112)

Remove POST /apps, DELETE /apps/{id}, and POST /apps/{id}/deploy from
the API v1 route group. These endpoints used cookie-based session auth
without CSRF protection, creating a CSRF vulnerability.

Read-only endpoints (GET /apps, GET /apps/{id}, GET /apps/{id}/deployments),
login, and whoami are retained.

Removed handlers: HandleAPICreateApp, HandleAPIDeleteApp,
HandleAPITriggerDeploy, along with apiCreateRequest struct and
validateCreateRequest function.

Updated tests to use service layer directly for app creation in
remaining read-only endpoint tests.

internal/server/routes.go

@@ -114,10 +114,7 @@ func (s *Server) SetupRoutes() {
 			r.Get("/whoami", s.handlers.HandleAPIWhoAmI())
 
 			r.Get("/apps", s.handlers.HandleAPIListApps())
-			r.Post("/apps", s.handlers.HandleAPICreateApp())
 			r.Get("/apps/{id}", s.handlers.HandleAPIGetApp())
-			r.Delete("/apps/{id}", s.handlers.HandleAPIDeleteApp())
-			r.Post("/apps/{id}/deploy", s.handlers.HandleAPITriggerDeploy())
 			r.Get("/apps/{id}/deployments", s.handlers.HandleAPIListDeployments())
 		})
 	})