apimeta: serve the api-meta.json a self-mounted /query owes the instance

core-go serves this file for a service assembled through WithSchema, which
mounts /query on the authenticated router. A service whose API must answer
anonymous callers cannot use that — core-go's auth middleware 401s an
un-cookied request — so it mounts /query itself, and then nothing serves the
file meta.sr.ht reads to build its personal-token page.

The scope list is variadic and marshals empty rather than null, which is the
whole reason this is a package and not four lines per service: meta iterates
every discovered service's scopes on ONE page, so a single `"scopes": null`
is a 500 on /oauth2/personal-token for the entire instance rather than one
degraded entry — a failure nobody would find by testing the service that
caused it.