audit(capsule): batch 5 — api/ sample (5 modules) = 36/272 (13.2%)

Sampled api/middleware, api/ai, api/wallet, api/rate-limit, api/index
from the largest unaudited subtree (45 top-level .ts files).

Distribution: 0 A, 1 A-, 3 B, 1 C.

CRITICAL FINDING #1: api/middleware.ts already implements
`requireCapability(scope)` middleware using the 14-scope vocabulary from
types/capabilities.ts (the Batch 1 finding). Combined with
populatePrincipal() and the CapabilityPrincipal interface, pc2-node has a
WORKING capability-token enforcement layer at HTTP request time. This is
the second piece of pre-existing capsule infrastructure (after
capabilities.ts) — the migration story shortens further.

CRITICAL FINDING #2: api/index.ts (1,766 LOC, 40+ concrete imports) is
the SECOND canonical C-class module alongside ConnectivityService. Both
are mega-orchestrators wiring everything into a single entry-point. The
pattern repeats once on each side of the codebase (network ingress vs
HTTP ingress). Both will be retired by the Runtime capsule architecture
(capsules don't have single mega-entry-points).

Pattern updates:
- Concrete-class imports: now 7+ confirmed across 4 subtrees (ai, storage,
  boson, api). Promote to single Phase 2 ticket: extract ~5-6 interfaces.
- Global singleton: storage/index.ts getDatabase() is ACTIVELY USED by
  api/wallet.ts — not dead code. Expect to find more uses in remaining
  ~40 api/ files.
- Express type coupling: forces all 45 api/ handlers to B-class at best.
  Design decision deferred to Runtime convergence (capsules don't use
  Express anyway).

Strategic implication (refined verdict in §5.4):
- (a) Runtime team can lift A-class leaves as crates immediately:
  boson-crypto, boson-protocol, ai-providers, storage-migrations — all
  building on the existing capability vocabulary.
- (b) PC2 team can refactor B-class orchestrators and handlers
  (~15-20 days total; cross-cutting interface extraction is one ticket
  covering 7+ modules).
- (c) Both C-class mega-orchestrators wait for Runtime substrate; the
  capsule architecture eliminates the mega-orchestrator pattern itself.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: SashaMIT