Scaffold the Hono app and port the middleware layer

Set up the Hono application shell that the route ports will slot into.

• Hono + @hono/node-server, listening on the same port behind Traefik
• cors -> hono/cors (origins from env), cookie-parser -> hono/cookie, helmet -> hono/secure-headers
• requireAdmin becomes a small middleware reading the token cookie via getCookie and verifying the JWT
• AppError/errorHandler/asyncHandler are replaced by HTTPException and app.onError; async handlers need no wrapper in Hono
• /api/health ported so there's a running, deployable skeleton from day one