Phase 4: move catalog controllers and routes into WarpEngine

- update, files and the 6 /api catalog controllers now live in the engine on
  a new WarpEngine::ApiController base (same rescue/mime behavior as host)
- engine routes serve /update, /file/*path, /api/software*, /api/builds*,
  /api/image/:id, /api/download at unchanged public paths via the root mount;
  host routes keep only TTG endpoints (events, members, wiki, rss, swagger)
- /update secret comes from WarpEngine.config.update_secret and an
  unconfigured secret now rejects every request (previously an empty
  UPDATE_SECRET env accepted empty secrets)
- apipie-rails is an engine dependency (DSL in engine controllers); dummy app
  configures apipie with validation off, mirroring the host
- engine request specs: catalog controller specs moved from host plus new
  /update auth contract spec

Verified: engine suite 53 green, host suite 6 green, /api/software and
/api/builds byte-identical to baselines, /update 401/400 behavior intact,
admin and TTG endpoints OK.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

apps/api/config/routes.rb

@@ -5,22 +5,16 @@ Rails.application.routes.draw do
 
   namespace :api do
     get "swagger",              to: "swagger#index"
-    get "software",             to: "software#index"
-    get "software/highlighted", to: "software_highlighted#index"
     get "events",               to: "events#index"
     get "members",              to: "members#index"
-    get "image/:id",            to: "images#show"
     get "wiki/pages",           to: "wiki#index"
     get "rss/blog",             to: "rss#blog"
     get "rss/releases",         to: "rss#releases"
     get "rss/howtos",           to: "rss#howtos"
-    get "download",             to: "downloads#show"
-    get "builds",               to: "builds#index"
-    get "softwares/:name/builds", to: "software_builds#show"
   end
-  get "update",       to: "update#update"
-  get "file/*path",   to: "files#show", format: false
 
-  # Utolsó sor: a host route-jai nyernek, minden mást az engine kap el.
+  # Utolsó sor: a host route-jai nyernek, a katalógus-útvonalakat
+  # (/api/software*, /api/builds*, /api/image, /api/download, /update, /file/*)
+  # az engine adja.
   mount WarpEngine::Engine => "/"
 end