Add routing for spawn-related endpoints to HttpMixin:
- GET /api/projects -> _handle_projects
- GET /api/health -> _handle_health
- POST /api/spawn -> _handle_spawn
- POST /api/projects/refresh -> _handle_projects_refresh
Update CORS preflight (AC-39) to include GET in allowed methods
and Authorization in allowed headers.
Closes bd-2al