Resolve #3585327 "Add HTTP API endpoint for canvasData.v0"

Add GET /canvas/api/v0/canvas-data endpoint that returns the full canvasData.v0 payload — the same data Drupal injects via window.drupalSettings.canvasData.v0 during a full page render.

Workbench runs as a local Vite dev server with no Drupal page render, so getSiteData() and getPageData() cannot read from drupalSettings. This endpoint lets Workbench bootstrap with live site data.

PHP changes:

• New route canvas.api.canvas_data (GET /canvas/api/v0/canvas-data) with _canvas_authentication_required, _canvas_ui_access, and canvas_external_api: true
• New CanvasDataController::get() — calls CodeComponentDataProvider::getCanvasDataAllV0()
• New CodeComponentDataProvider::getCanvasDataAllV0() — aggregates all seven provider methods (baseUrl, branding, breadcrumbs, jsonapiSettings, mainEntity, pageTitle, themeAssets) without dynamic dispatch
• canvas.api.v0.canvas_data added to CanvasOauthAuthenticationProvider::applies() so OAuth Bearer token requests authenticate correctly

TypeScript changes (@drupal-canvas/vite-plugin):

• buildStart hook: reads OAuth token from CANVAS_ACCESS_TOKEN env var or ~/.config/drupal-canvas/oauth.json, fetches /canvas/api/v0/canvas-data, caches response
• transformIndexHtml: merges API response into window.drupalSettings.canvasData.v0; falls back to static siteUrl/jsonapiPrefix config when no API data is available (backward-compatible)

AI Disclosure: Used Claude Code to scaffold implementation based on the proposed resolution in the issue summary. See: https://www.drupal.org/docs/develop/issues/issue-procedures-and-etiquette/policy-on-the-use-of-ai-when-contributing-to-drupal

Testing instructions

• Install Canvas with canvas_oauth and jsonapi enabled
• Authenticate via canvas login to store an OAuth token
• curl -H "Authorization: Bearer <token>" -H "Accept: application/json" https://example.com/canvas/api/v0/canvas-data — expect 200 with baseUrl, branding, themeAssets, jsonapiSettings keys
• Anonymous request to same URL — expect 403
• In a Workbench project using @drupal-canvas/vite-plugin, start the dev server — window.drupalSettings.canvasData.v0 should contain full site data in the browser console