fix(server): declare Allow: GET on the new 405 responses

RFC 9110 section 15.5.6 requires a 405 to name the methods it accepts, and
/api/radio/stations already does this in-tree. Thanks to kvnloo for catching it
on review. The same gap on the pre-existing handlers is tracked in #809 and is
deliberately left alone here.

src/tooling/liveProviders.test.mjs

@@ -398,6 +398,9 @@ test('the aircraft snapshot routes decline a non-GET before any upstream work',
     for (const method of ['POST', 'PUT', 'DELETE', 'PATCH']) {
       const response = await request(route, '/', method);
       assert.equal(response.statusCode, 405, `${method} ${route}`);
+      // RFC 9110 section 15.5.6 requires a 405 to name the methods it does
+      // accept, which is what `/api/radio/stations` already does in-tree.
+      assert.equal(response.headers.allow, 'GET', `${method} ${route}`);
       assert.deepEqual(JSON.parse(response.body), {
         error: 'Method Not Allowed',
       });

src/tooling/placeProviders.test.mjs

@@ -498,6 +498,8 @@ test('the routing proxy declines a non-GET before rate limiting or upstream', as
       method,
     );
     assert.equal(response.statusCode, 405, method);
+    // RFC 9110 section 15.5.6 requires a 405 to name the methods it accepts.
+    assert.equal(response.headers.allow, 'GET', method);
     assert.deepEqual(response.body, { error: 'Method Not Allowed' });
   }
 });