fix(web): route Mission Control API calls through orchestrator proxy

The Mission Control components were calling /api/mission-control/* which
routes to mosaic-api.woltje.com (the main API) — those routes don't exist
there, causing 404s.

These routes live on the orchestrator service and must go through the
Next.js server-side proxy (which injects ORCHESTRATOR_API_KEY):

Changes:
- Add catch-all proxy route at /api/orchestrator/[...path]/route.ts
  Forwards any GET/POST/PATCH/PUT/DELETE to ORCHESTRATOR_URL/<path>
  Replaces the need for per-endpoint proxy files for new routes.
- Update all Mission Control components to call
  /api/orchestrator/api/mission-control/* instead of /api/mission-control/*
- Update test expectations to match new paths

apps/web/src/components/mission-control/PanelControls.tsx

@@ -50,23 +50,23 @@ export function PanelControls({
       switch (action) {
         case "pause":
           await apiPost<{ message: string }>(
-            `/api/mission-control/sessions/${encodeURIComponent(sessionId)}/pause`
+            `/api/orchestrator/api/mission-control/sessions/${encodeURIComponent(sessionId)}/pause`
           );
           return { nextStatus: "paused" };
         case "resume":
           await apiPost<{ message: string }>(
-            `/api/mission-control/sessions/${encodeURIComponent(sessionId)}/resume`
+            `/api/orchestrator/api/mission-control/sessions/${encodeURIComponent(sessionId)}/resume`
           );
           return { nextStatus: "active" };
         case "graceful-kill":
           await apiPost<{ message: string }>(
-            `/api/mission-control/sessions/${encodeURIComponent(sessionId)}/kill`,
+            `/api/orchestrator/api/mission-control/sessions/${encodeURIComponent(sessionId)}/kill`,
             { force: false }
           );
           return { nextStatus: "killed" };
         case "force-kill":
           await apiPost<{ message: string }>(
-            `/api/mission-control/sessions/${encodeURIComponent(sessionId)}/kill`,
+            `/api/orchestrator/api/mission-control/sessions/${encodeURIComponent(sessionId)}/kill`,
             { force: true }
           );
           return { nextStatus: "killed" };