feat(server): add spawn API HTTP routes

Add routing for spawn-related endpoints to HttpMixin:
- GET /api/projects -> _handle_projects
- GET /api/health -> _handle_health
- POST /api/spawn -> _handle_spawn
- POST /api/projects/refresh -> _handle_projects_refresh

Update CORS preflight (AC-39) to include GET in allowed methods
and Authorization in allowed headers.

Closes bd-2al

tests/test_http.py

@@ -268,6 +268,34 @@ class TestDoGet(unittest.TestCase):
         handler._json_error.assert_called_with(404, "Not Found")
 
 
+class TestDoGetSpawnRoutes(unittest.TestCase):
+    """Tests for spawn-related GET routes."""
+
+    def _make_handler(self, path):
+        handler = DummyHttpHandler()
+        handler.path = path
+        handler._serve_dashboard_file = MagicMock()
+        handler._serve_state = MagicMock()
+        handler._serve_stream = MagicMock()
+        handler._serve_events = MagicMock()
+        handler._serve_conversation = MagicMock()
+        handler._serve_skills = MagicMock()
+        handler._handle_projects = MagicMock()
+        handler._handle_health = MagicMock()
+        handler._json_error = MagicMock()
+        return handler
+
+    def test_api_projects_routed(self):
+        handler = self._make_handler("/api/projects")
+        handler.do_GET()
+        handler._handle_projects.assert_called_once()
+
+    def test_api_health_routed(self):
+        handler = self._make_handler("/api/health")
+        handler.do_GET()
+        handler._handle_health.assert_called_once()
+
+
 class TestDoPost(unittest.TestCase):
     """Tests for do_POST routing edge cases."""
 
@@ -277,6 +305,8 @@ class TestDoPost(unittest.TestCase):
         handler._dismiss_dead_sessions = MagicMock()
         handler._dismiss_session = MagicMock()
         handler._respond_to_session = MagicMock()
+        handler._handle_spawn = MagicMock()
+        handler._handle_projects_refresh = MagicMock()
         handler._json_error = MagicMock()
         return handler
 
@@ -300,6 +330,16 @@ class TestDoPost(unittest.TestCase):
         handler.do_POST()
         handler._respond_to_session.assert_called_with("session-xyz")
 
+    def test_spawn_routed(self):
+        handler = self._make_handler("/api/spawn")
+        handler.do_POST()
+        handler._handle_spawn.assert_called_once()
+
+    def test_projects_refresh_routed(self):
+        handler = self._make_handler("/api/projects/refresh")
+        handler.do_POST()
+        handler._handle_projects_refresh.assert_called_once()
+
     def test_unknown_post_path_returns_404(self):
         handler = self._make_handler("/api/unknown")
         handler.do_POST()
@@ -316,7 +356,9 @@ class TestDoOptions(unittest.TestCase):
         self.assertEqual(handler.response_code, 204)
         self.assertEqual(handler.headers_sent["Access-Control-Allow-Origin"], "*")
         self.assertIn("POST", handler.headers_sent["Access-Control-Allow-Methods"])
+        self.assertIn("GET", handler.headers_sent["Access-Control-Allow-Methods"])
         self.assertIn("Content-Type", handler.headers_sent["Access-Control-Allow-Headers"])
+        self.assertIn("Authorization", handler.headers_sent["Access-Control-Allow-Headers"])
 
 
 class TestJsonError(unittest.TestCase):