api: JSON API over the engine; server mode in cmd/spreadlab

internal/api stays a translation layer: decode (with
DisallowUnknownFields so typos 400 instead of silently defaulting),
run the engine, encode; all validation stays in the engine. Routes use
Go 1.22 mux patterns ('POST /api/comparison'), so wrong methods get
405 from the stdlib for free. httptest runs handlers fully in memory;
the API test re-pins the 99/70/7 golden values end to end.
ComparisonResponse is added to tygo.yaml with a type mapping so the
generated web/src/types/api.ts reuses the engine's TS types.
cmd/spreadlab now serves on -addr (default localhost:8080); -table
keeps the CLI comparison as a sanity check.

web/src/types/api.ts

@@ -0,0 +1,20 @@
+// Code generated by tygo. DO NOT EDIT.
+import type { Config, Result } from "./engine";
+
+//////////
+// source: api.go
+/*
+Package api exposes the engine over HTTP as a small JSON API. It stays
+thin on purpose: decode, run the engine, encode. All validation lives in
+the engine; the API only translates errors into status codes.
+*/
+
+/**
+ * ComparisonResponse bundles what the dashboard needs to render one
+ * comparison: the config that was run, echoed back so frontend state stays
+ * honest, and one result per strategy.
+ */
+export interface ComparisonResponse {
+  config: Config;
+  results: Result[];
+}