Whitelist api.{apex} as a shared public host

api.{apex} is the client's primary API host, served by path
dispatch across every service. It belonged to no route group's
HostSubdomains, so it was absent from PublicSubdomains and thus
from the monolith's HostFiltering AllowedHosts — every request to
api.{apex} was rejected with 400 "Bad Request - Invalid Hostname".

Append "api" alongside admin/feed so it is whitelisted while
remaining path-routed (it owns no service by host).

DorkNet.Contracts/DorkNetRouteOwnership.cs

@@ -167,6 +167,11 @@ public static class DorkNetRouteOwnership
     public static IReadOnlyList<string> PublicSubdomains =>
         ServiceRouteGroups
             .SelectMany(group => group.HostSubdomains)
+            // api.* is a shared public host: it owns no service by host and is
+            // dispatched by path (see ResolvePublicService's path-prefix pass),
+            // so it never appears in a group's HostSubdomains. It must still be
+            // whitelisted here or HostFiltering rejects every api.{apex} request.
+            .Append("api")
             .Append(AdminHost)
             .Append("feed")
             .Distinct(StringComparer.OrdinalIgnoreCase)