frontend: standardize method-not-allowed responses across proxy routes

## Problem Only some Next.js proxy routes return a consistent JSON 405 response with an Allow header. ## Scope - Reuse `methodNotAllowed` from `app/lib/api/proxy.ts` across high-traffic API routes. - Start with auth, users, confessions, comments, and notifications routes. ## Acceptance criteria - Unsupported methods return `{ code: METHOD_NOT_ALLOWED }`. - Responses include an `Allow` header. - Add focused route tests for at least two routes. ## Validation Run: `npm run test --workspace=xconfess-frontend -- app/api --runInBand`