api server corrections

- index: fix app.listen() error handling — callback never receives err,
  bind failures are emitted as 'error' events; use server.on('error', ...)
- app: add error-handling middleware to catch unhandled route errors and
  return a safe 500 JSON response instead of leaking stack traces
- package.json: remove unused cookie-parser and @types/cookie-parser

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

artifacts/api-server/src/app.ts

@@ -1,4 +1,4 @@
-import express, { type Express } from "express";
+import express, { type Express, type NextFunction, type Request, type Response } from "express";
 import cors from "cors";
 import pinoHttp from "pino-http";
 import router from "./routes";
@@ -31,4 +31,9 @@ app.use(express.urlencoded({ extended: true }));
 
 app.use("/api", router);
 
+app.use((err: Error, _req: Request, res: Response, _next: NextFunction) => {
+  logger.error({ err }, "Unhandled error");
+  res.status(500).json({ error: "Internal server error" });
+});
+
 export default app;