Fix appload() returning a coerced HTTP 200 instead of a 404

ItemController::appload() was declared ': ?string', so its two error
branches that 'return response()->json([...], 404)' had the JsonResponse
coerced through Response::__toString() into a raw HTTP message served as
an HTTP 200 body. Widen the return type to
'\Illuminate\Http\JsonResponse|string|null' so those branches emit
real 404 JSON responses. The method body is unchanged, so the happy path
still returns the same JSON string and the frontend contract is preserved.

Flip the endpoint characterization test to assert the corrected 404.

app/Http/Controllers/ItemController.php

@@ -430,7 +430,7 @@ class ItemController extends Controller
      *
      * @throws GuzzleException
      */
-    public function appload(Request $request): ?string
+    public function appload(Request $request): \Illuminate\Http\JsonResponse|string|null
     {
         $output = [];
         $appid = $request->input('app');