Add content negotiation for shared hostname

[tylerhunt]

Summary

The dashboard and JSON API share the `bates.test` hostname. Currently they are separated by distinct pipeline routes (`/status` is API-only, `/` is browser-only). The spec calls for content negotiation so the same paths can serve both.

What needs to happen

• Browser requests (`Accept: text/html`) get the dashboard/HTML responses
• JSON requests (`Accept: application/json`) or explicit `.json` paths get the API
• This would allow `GET bates.test/status` to return HTML in a browser and JSON for API clients

References

• `specs/control-interface.md` — Content Negotiation