…API (#559)

Today the SPA reaches the JSON API by an *implicit* convention:
`django_admin_react.urls` inline-includes `django-admin-rest-api` at
`<spa-mount>/api/v1/`, and the SPA derives its API base from
`request.path`. That's plug-and-play but locks the consumer into the
assumption that the API lives **under** the SPA's mount.

A new optional `DJANGO_ADMIN_REACT["API_URL_PREFIX"]` setting lets a
consumer point the SPA at a separately-mounted `django-admin-rest-api`
so the API can be a single shared mount (also reachable by
`django-admin-mcp-api` or non-browser clients), and the SPA hits
**that** URL instead of the inline include.

## What changes
- `conf.py`: new `"API_URL_PREFIX": None` default. Unset → today's
  behaviour, unchanged.
- `urls.py`: when `API_URL_PREFIX` is set, the inline
  `include("django_admin_rest_api.api.urls")` is **skipped** so there's
  no double-mount.
- `views.py`: `_resolve_api_prefix(request)` resolves the prefix
  (consumer override → trailing-slash-normalized; else
  `<mount>/api/v1/`), injected into the SPA template.
- `templates/admin_react/index.html`: new
  `<meta name="dar-api-prefix" content="…">`.
- Frontend `main.tsx`: reads the meta + passes `apiPrefix` to the
  `ApiClient`.
- Frontend `client.ts`: `ApiClient` accepts optional `apiPrefix` and
  uses it to build every URL; defaults to `<mount>api/v1/` so consumers
  who don't set the override see no change.

## Tests
- Backend (`test_spa_index.py`): default → meta is `<mount>/api/v1/`;
  override → meta is the override verbatim; missing-trailing-slash →
  resolver adds one. Full suite **45 passed**.
- Frontend (`client.test.ts`): override routes every request through
  it; missing-trailing-slash gets one; omitted prefix keeps the legacy
  `<mount>api/v1/` path. Full vitest **145 passed**.

Closes #559

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>