fix(server): prevent SPA fallback from swallowing API routes

- add ShouldSkipSPAFallback() deny prefixes: /api, /admin/api, /payments, /pay
- apply StaticWithConfig Skipper in both main http server and install server
- add unit tests for fallback skip matching behavior

src/install/installer.go

@@ -28,6 +28,7 @@ import (
 	"text/template"
 	"time"
 
+	luluHttp "github.com/assimon/luuu/util/http"
 	"github.com/gookit/color"
 	"github.com/labstack/echo/v4"
 	"github.com/labstack/echo/v4/middleware"
@@ -195,6 +196,9 @@ func RunInstallServer(listenAddr, envFilePath string) {
 		}
 	}
 	e.Use(middleware.StaticWithConfig(middleware.StaticConfig{
+		Skipper: func(c echo.Context) bool {
+			return luluHttp.ShouldSkipSPAFallback(c.Request().URL.Path)
+		},
 		HTML5: true,
 		Index: "index.html",
 		Root:  wwwRoot,