chore(api): bump to Symfony 7.4 and API Platform 4.3

[BySplashGm]

Unrelated to the protocol work, and mergeable on its own: the api/ lockfile could
not be installed at all.

lcobucci/jwt 5.3.0 caps at PHP 8.3 and 5.6.0 is the first release accepting 8.5, so
composer install failed outright on a current PHP. Fixing that pulled the rest:

• Symfony 7.1.* → 7.4.*. symfony/mercure-bundle ^0.5 requires
  symfony/config ^6.4|^7.3|^8.0, so 7.1 is not enough; 7.4 is the current stable.
• api-platform/symfony and api-platform/doctrine-orm ^4.0.0-alpha.6 → ^4.3,
  which is what brings phpstan/phpdoc-parser ^2.0 into the allowed range.
• config.platform.php pinned to 8.2.0, the floor require.php declares, so the
  lock resolves against the bottom of the supported range and stays installable
  across it rather than only at the top.

None of the files the Flex recipes wrote are kept. config/reference.php is
generated, so it is gitignored. config/routes/api_platform.yaml redeclares the
api_platform loader already present in config/routes.yaml and adds prefix: /api
on top, which would move every route. config/packages/property_info.yaml changed
nothing the application needs. symfony.lock records the recipes as installed but no
longer claims those two files, so composer recipes reports the tree as it is.

This does not enable protocol_version: '1.0'. The stock FrankenPHP image
embeds Mercure 0.24.2:

$ docker run --rm dunglas/frankenphp:1-php8.5 frankenphp build-info
dep  github.com/dunglas/mercure        v0.24.2
dep  github.com/dunglas/mercure/caddy  v0.24.2

so a 1.0 configuration would be rejected by the module actually running. That needs a
custom FrankenPHP build and is tracked separately.

---

Verification. Dependency resolution only — the lock installs. The container was
never booted, since api/ cannot speak 1.0 until the FrankenPHP question is settled.