api server corrections

- index: fix app.listen() error handling — callback never receives err,
  bind failures are emitted as 'error' events; use server.on('error', ...)
- app: add error-handling middleware to catch unhandled route errors and
  return a safe 500 JSON response instead of leaking stack traces
- package.json: remove unused cookie-parser and @types/cookie-parser

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

artifacts/api-server/package.json

@@ -12,7 +12,6 @@
   "dependencies": {
     "@workspace/api-zod": "workspace:*",
     "@workspace/db": "workspace:*",
-    "cookie-parser": "^1.4.7",
     "cors": "^2",
     "drizzle-orm": "catalog:",
     "express": "^5",
@@ -20,7 +19,6 @@
     "pino-http": "^10"
   },
   "devDependencies": {
-    "@types/cookie-parser": "^1.4.10",
     "@types/cors": "^2.8.19",
     "@types/express": "^5.0.6",
     "@types/node": "catalog:",