Return JSON, not plain text, from the Autumn route's 404

autumn-js's client hooks call response.json() on every response regardless
of status. The plain-text "Not found" body from the previous commit's guard
made that throw a SyntaxError client-side ("Unexpected token 'N'...") in
hosted mode once Autumn-dependent UI actually mounted and called it.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/routes/api/autumn/$.ts

@@ -60,9 +60,13 @@ async function handleAutumnRequest(request: Request) {
   // loadHandler(), avoids autumn-js throwing "secret key not found" deep
   // inside the handler once a client request reaches it.
   if (!isHostedAuthMode(env.AUTH_MODE) || !env.AUTUMN_SECRET_KEY?.trim()) {
-    return new Response("Not found", {
-      status: 404,
-    });
+    // JSON, not a plain-text body: the client-side autumn-js hooks call
+    // response.json() on every response regardless of status, and a
+    // non-JSON body throws a SyntaxError there instead of handling the 404.
+    return Response.json(
+      { message: "Not found", code: "not_found" },
+      { status: 404 },
+    );
   }
 
   let context;