fix(api): harden startup logging and request handling

[techadnank9]

Summary

This PR includes a small set of focused fixes that improve local dev startup and API request handling:

• scope vite-tsconfig-paths to the UI app so pnpm dev no longer emits the docs tsconfig warning
• tighten API CORS allowlist matching to use exact origin membership
• skip request body parsing/logging for streamed package uploads
• log API readiness only after the server successfully binds its port

Why

These changes address a few concrete issues found during local setup:

• the UI dev server was scanning apps/docs/tsconfig.json and printing a misleading warning on startup
• API CORS origin validation used substring matching against a comma-delimited env var
• upload requests could be cloned and JSON-parsed unnecessarily during request logging
• the API printed "Server running" before bind success, which made EADDRINUSE failures look like successful boots

Testing

Ran:

• pnpm --filter @autonoma/api test
• pnpm --filter @autonoma/api typecheck
• pnpm --filter @autonoma/api lint

Commit breakdown

• fix(ui): scope tsconfig path discovery
• fix(api): tighten CORS origin matching
• fix(api): skip upload body logging
• fix(api): log readiness after server bind