Remove SPA catch-all, add vendor route and JSON 404 handler

The SPA uses hash-based routing, so the catch-all route was dead code.
Replace with explicit routes for / and /vendor/<path>, plus a 404
handler that returns JSON for /api/ paths and empty HTML otherwise.

tests/test_server.py

@@ -20,18 +20,17 @@ class TestSPARoutes:
         assert resp.status_code == 200
         assert b'id="app"' in resp.data
 
-    def test_spa_catch_all_serves_index(self, client):
+    def test_spa_unknown_path_404(self, client):
         resp = client.get("/dashboard")
-        assert resp.status_code == 200
-        assert b"index.html" in resp.data or b'id="app"' in resp.data
+        assert resp.status_code == 404
 
-    def test_spa_catch_all_other_page(self, client):
+    def test_spa_unknown_path_404_other(self, client):
         resp = client.get("/zones")
-        assert resp.status_code == 200
+        assert resp.status_code == 404
 
     def test_api_routes_still_work(self, client):
         resp = client.get("/api/firewall/zones")
-        assert resp.status_code in (200, 502, 503)
+        assert resp.status_code in (200, 500)
 
 
 class TestWsUrlGeneration: