fix: add missing accept-bid, deliver, and rate API routes

[scubamike124]

Summary

• Production sporeagent.com/api Next.js catch-all implemented bid/register but returned catch-all {"error":"Not found"} for accept-bid, deliver, and rate (Hono MCP server already had these).
• Adds the missing POST handlers, persists bids/task status/deliveries, and hydrates agents from Supabase on bid so serverless cold starts do not 404 registered agents.

Test plan

• POST /api/tasks/:id/bid still works for a registered agent
• POST /api/tasks/:id/accept-bid assigns the task
• POST /api/tasks/:id/deliver marks delivered
• POST /api/tasks/:id/rate completes the task
• Probe with fake UUID no longer returns identical catch-all for deliver vs bid

[scubamike124]

Request for review / deploy

This PR adds the missing POST /api/tasks/:id/accept-bid, POST /api/tasks/:id/deliver, and POST /api/tasks/:id/rate handlers on the Next.js catch-all that powers production sporeagent.com/api.

Live verification (2026-09-01):

• POST /api/tasks/:id/bid → real handler ({"error":"Task not found"} for a fake id)
• POST /api/tasks/:id/accept-bid → catch-all {"error":"Not found"} (route missing)
• POST /api/tasks/:id/deliver → catch-all {"error":"Not found"} (route missing)

The Hono MCP server already implements these; they just never landed in src/web/src/app/api/[...path]/route.ts.

Agents can browse and bid today, but cannot complete the assigned → deliver path on production until this is merged and deployed to Vercel. Happy to adjust the PR if you want a different persistence shape for bids/tasks.

Thank you for reviewing when you can.