fix(edge): route /app and /api on d3ro.chanpaca.net through the NAS tunnel again

Since 2026-09-19 the site bridge worker served every path from Pages, so the
API server on the NAS had no public route: admin login (API_SERVER_URL)
and stt-proxy (D3RO_API_URL) called https://d3ro.chanpaca.net/api/... and
got the landing page's 405.

- The worker passes /app, /api and /health through to the domain origin
  (the kd-nas tunnel) and serves everything else from Pages.
- The kd-nas tunnel sends path ^/app on d3ro.chanpaca.net to the web app
  (NAS 3002); other paths keep going to the API (NAS 5050). No extra
  hostname or DNS record is needed, so WEB_APP_ORIGIN is removed.
- API_PATH_PREFIXES joins WEB_APP_BASE_PATH in packages/core/src/web-urls.ts
  (contract regenerated).

Verified live: /app/login 200, /health and /api/health 200, API login 401 for
an unknown account (was 405), landing/legal/404 unchanged, git/sso/admin
hosts unaffected.

server/cloudflare-site-bridge/wrangler.toml

@@ -18,8 +18,3 @@ compatibility_date = "2024-04-01"
 routes = [
   { pattern = "d3ro.chanpaca.net/*", zone_name = "chanpaca.net" }
 ]
-
-# 웹앱(apps/web) 컨테이너를 노출한 Cloudflare Tunnel 호스트. 터널 공개 호스트를 추가한 뒤 채운다.
-# 비어 있으면 /app/* 는 503 을 돌려준다(랜딩으로 떨어뜨리지 않는다).
-[vars]
-WEB_APP_ORIGIN = ""