Add tests for untested server API endpoints (token-types, tokens/preview, manifests, distribute)

[LiorFink00]

Found during a full feature-coverage audit on main (fc58e08). These features work (verified live where reachable) — the gap is missing automated tests, not broken behavior.

These routes in server/thumper/api/routes.py have no HTTP test (I hit them live and they return correct data):

• GET /api/token-types (routes.py:434) — token catalog; also covers tokens/catalog.py which has no test.
• POST /api/tokens/preview (routes.py:439) — renders a preview honeytoken per type/source.
• GET /api/manifests (routes.py:449) — public plugin manifests.
• POST /api/tripwires/{tid}/distribute route wrapper (routes.py:298) — the underlying distribute() service is tested (test_deploy_isolation.py), but the HTTP route + 404 branch is not.
• GET /api/endpoints/{eid} and GET /api/agent/deployments/{id}/content — no direct 404/detail test.

Pattern to follow: the existing test_tripwire_crud.py / test_alert_management.py (admin-token client fixtures).