test(web): real-composition webserver spec

Boots a test-only cordis.yml through the real Loader and asserts the route
service's behavior surface: exact/longest-prefix matching, tapIndex
transform order and unsubscription, traversal 403, non-GET 405, SPA-200
fallback, malformed-request 400 without process exit, duplicate-pattern
throw, dispose closing held connections with register/disposer symmetry,
and a listen-failure fail-loud case (EADDRINUSE -> FAILED fiber + late
rejection). Replaces the retired factory-era specs.

apps/cli/tsconfig.json

@@ -14,9 +14,6 @@
     {
       "path": "../../packages/host/apiproxy"
     },
-    {
-      "path": "../../packages/host/runtime"
-    },
     {
       "path": "../../packages/host/webserver"
     },