Not found: an unknown /api path answers JSON ({ error: 'Not found' }), as Media's API routes do, not the HTML page (#140)

ddiff --git a/server/not-found.js b/server/not-found.js
iindex d276652..c9a3e1f 100644
---- a/server/not-found.js
++++ b/server/not-found.js
@@@ -18,8 +18,10 @@ const esc = (s) => String(s).replace(/[&<>"']/g, (c) => ESC[c]);
  
  function notFound(req, res) {
      res.status(404);
--    res.set('Content-Security-Policy', CSP);
      res.set('X-Content-Type-Options', 'nosniff');
++    // An API caller gets JSON, as from Media's own API routes (it got this HTML page).
++    if (req.path === '/api' || req.path.startsWith('/api/')) return res.json({ error: 'Not found' });
++    res.set('Content-Security-Policy', CSP);
      res.type('html').send(`<!DOCTYPE html>
  <html lang="en">
  <head>
ddiff --git a/test/observability.test.js b/test/observability.test.js
iindex 0689d92..a37339f 100644
---- a/test/observability.test.js
++++ b/test/observability.test.js
@@@ -160,6 +160,10 @@ const { spawn } = require('child_process');
              }).on('error', reject));
              assert.deepStrictEqual([nf.status, nf.csp], [404, require('../server/not-found').CSP]);
              assert.ok(nf.body.includes('<pre>Cannot GET /__ovcheck-404</pre>'));
++            // ...and an unknown /api path is JSON, as from Media's API routes.
++            const api404 = await request(b2, '/api/nope');
++            assert.strictEqual(api404.status, 404);
++            assert.deepStrictEqual(typeof api404.body === 'string' ? JSON.parse(api404.body) : api404.body, { error: 'Not found' });
              // The release manifest (registry.release-manifest@1) names where open tabs report updates,
              // and those reports land in /metrics.
              const rel = await request(b2, '/release.json');