fix(arc-paste): default-deny via allowlist + scrub stale dual-URL docs

[bfirestone]

Follow-up to #47 addressing two findings from an adversarial review of that PR.

1. arc-paste binary now genuinely mirrors the Caddy edge

Previously the in-binary guards only blocked / and /api/v1/*. Every other path (/labels, /dashboard, /<projectId>/issues, etc.) still fell through the SPA wildcard registered by web.RegisterSPA and served the arc app shell — exactly the failure mode #47 claimed to fix. The "Mirrors the Caddy edge config so dev and prod behave the same" comment overclaimed.

Replaced with a single allowlist middleware (arcPasteAllowedPath) that mirrors the Caddyfile @assets + @share matchers exactly:

• /_app/*
• /api/paste
• /api/paste/*
• /robots.txt
• /share/<single-segment>

Tests cover both the rejected set (including shape edges like /share/, /share/a/b, /api/pasteX, /robots.txt.bak) and the allowed set, plus a direct table-driven test of the predicate.

The /api/v1/* JSON-404 carve-out is gone — Caddy returns text/plain at the edge, and the binary now matches. The arc SPA shell that motivated the JSON 404 doesn't load anymore (/ is 404), so nothing parses the body.

2. Documentation drift from the --share → --remote / single-URL output rename

docs/runbooks/review_howto.md still described the deprecated dual-URL CLI output (with a "Share URL" / "Author URL" table). docs/runbooks/paste-server.md had four lingering "Share URL" mentions that didn't match the new in-page Share link button flow.

• Rewrote the review_howto.md "URLs you'll receive" section around the Author URL / reviewer URL split, with the in-page Share-link button as the canonical reviewer-URL source.
• Replaced the paste-server.md mentions with consistent "reviewer URL" terminology matching the rest of the runbook.

Test plan

• go test -count=1 ./arc-paste/... ./cmd/arc/... passes (verified locally)
• make lint clean (verified locally — Go, Biome, ESLint, svelte-check)
• Manual: build with make build and run ./bin/arc-paste. curl -i http://localhost:7433/ → 404. curl -i http://localhost:7433/labels → 404. curl -i http://localhost:7433/dashboard → 404. curl -i http://localhost:7433/api/v1/projects → 404. curl -i http://localhost:7433/share/abc → 200 (the SPA shell). curl -i http://localhost:7433/api/paste -X POST … → 201 with a real CreatePasteRequest body.
• Doc check: search docs/ for any remaining Share URL references (should find none).