Make API route and capability coverage exhaustive and trustworthy

[sjohnston1972]

The master test plan overstates route-contract and authorization coverage. The API contract currently has 68 routes, while prior tests used partial hand-maintained subsets.

Acceptance criteria:

• Every handled API route is represented in apiRouteContract.
• A generated/table-driven test covers access and capability policy for every contract route.
• Explicit route tests include auth session, behavioural eval listing, Lab list/detail/rebuild-evidence, and repository manifest retrieval.
• Existing coverage statuses for operations metrics, diagnostics, sequence conflicts, and rate limiting are corrected.
• Route inventory drift fails CI.

[sjohnston1972]

Advanced in v0.25.18: all 68 contract entries are table-validated for resolution/access/capability; unmatched routes fail closed before authorization; missing operator capabilities return a contract error; route drift and nosniff have regression coverage. Remaining: explicit happy/failure handler tests for the named route families and exhaustive success-path authorization coverage.