Invoke app.server handlers over HTTP

The POST /api/apps/{appId}/server/{handlerName} endpoint now actually executes your handler instead of returning 501. Each call is billed as a server_call (10mc), with automatic refund if the handler errors. Requests must include a valid installation context, and the route verifies that the installation belongs to the requested app and that the caller has access before charging or running anything.