Add v1 capability discovery endpoint

[lost-rob0t]

Summary

Start issue #58 with a small, self-contained versioned API contract slice.

• add public GET /api/v1/capabilities
• return a stable {status,data} envelope
• advertise server/API/document schema revisions
• advertise the currently supported HTTP transport and configured auth mode
• expose current feature availability and bounded request/bulk limits
• enumerate the new discovery route plus the existing legacy document/search/target routes
• explicitly report target leases, streams, and OpenAPI as unavailable on the current canonical master
• add hermetic contract coverage to the existing required HTTP boundary suite
• prove configured credential/database/broker secrets are not emitted

This intentionally does not overlap PR #101 / issue #32 target-lease and fencing work.

Why

Clients such as Quasar need one stable request for feature detection instead of inferring server behavior from 404s or hard-coding legacy route assumptions. This is the first bounded piece of #58 rather than a wholesale API migration.

Validation

The branch is based exactly on canonical master 7834d6614378e01232a1c810249d9ae83cec25c5 and is currently 0 commits behind it.

Local execution was not available in this environment, so the PR is intentionally draft and CI is the validation authority for the Common Lisp test suite.

Refs #58