api: JSON API over the engine; server mode in cmd/spreadlab

internal/api stays a translation layer: decode (with
DisallowUnknownFields so typos 400 instead of silently defaulting),
run the engine, encode; all validation stays in the engine. Routes use
Go 1.22 mux patterns ('POST /api/comparison'), so wrong methods get
405 from the stdlib for free. httptest runs handlers fully in memory;
the API test re-pins the 99/70/7 golden values end to end.
ComparisonResponse is added to tygo.yaml with a type mapping so the
generated web/src/types/api.ts reuses the engine's TS types.
cmd/spreadlab now serves on -addr (default localhost:8080); -table
keeps the CLI comparison as a sanity check.

tygo.yaml

@@ -6,3 +6,12 @@ packages:
     output_path: "web/src/types/engine.ts"
     include_files:
       - "scenario.go"
+  - path: "github.com/JustinZeus/spreadlab/internal/api"
+    output_path: "web/src/types/api.ts"
+    include_files:
+      - "api.go"
+    frontmatter: |
+      import type { Config, Result } from "./engine";
+    type_mappings:
+      engine.Config: "Config"
+      engine.Result: "Result"