skaldsong: fix first-deploy footguns (SPA path + cors_origins shape)

Two corrections surfaced by the first end-to-end deploy that didn't
land in the pre-flight align:

- SPA static assets are at /app/spa, not /app/web/dist (Dockerfile
  COPYs the SvelteKit build output flat into /app/spa, not into
  /app/spa/dist). Mismatch caused /health to 500 with
  "RuntimeError: File at path /app/web/dist/index.html does not
  exist."

- SKALDSONG_HOST_CORS_ORIGINS must be a JSON array literal in .env.
  Pydantic-settings parses complex-typed env vars via json.loads();
  bare URL string fails first-boot with SettingsError.

Container now reports Up (healthy) on ana-docker; /health 200.

stacks/skaldsong/compose.yaml

@@ -73,9 +73,10 @@ services:
       SKALDSONG_TTS_ENGINE: "${SKALDSONG_TTS_ENGINE:-kokoro}"
       SKALDSONG_TTS_BASE_URL: "${SKALDSONG_TTS_BASE_URL:-http://10.100.79.3:8193}"
 
-      # SPA static assets — baked into the image at /app/web/dist by the
-      # Dockerfile's web-builder stage.
-      SKALDSONG_HOST_STATIC_ASSETS_PATH: /app/web/dist
+      # SPA static assets — baked into the image at /app/spa by the
+      # Dockerfile's web-builder stage (COPYs the SvelteKit build output
+      # flat into /app/spa, not into /app/spa/dist).
+      SKALDSONG_HOST_STATIC_ASSETS_PATH: /app/spa
 
       # Persistent state paths inside the container. The db/ parent
       # dir is the bind-mount target (not the file itself) so SQLite