feat(api): 1b — Route shell (all 25 routes as 501 stubs)

[neversettle17-101]

Part of #10 — Go HTTP Daemon lane.

🧭 Umbrella issue. The original "all 25 routes as 501 stubs" scope has been split into three reviewable sub-PRs after a REST audit of the existing TS surface revealed (a) the route count was undercounted and (b) several endpoints violate REST conventions. The Go shell corrects them; legacy paths are NOT registered and the mapping is documented via planned.legacy arrays on the 501 stubs.

Sub-issues

• feat(api): 1b·a — Projects route shell (7 routes, REST-corrected) #20 — #18a Projects route shell (7 canonical routes)
• feat(api): 1b — PR action route shell (merge + resolve-comments) #21 — #18b Sessions route shell (9 canonical routes)
• feat(api): 1b·c — Issues, PRs, runtime & remaining route shell #22 — #18c Issues / PRs / runtime / remaining routes (~12 routes — placeholder)

Closes when all three merge.

REST audit summary (locked across the three PRs)

#	TS violation	Go fix
R1	POST /api/spawn outside /sessions/	Canonical POST /api/v1/sessions. Legacy not registered.
R2	/message + /send duplicate POSTs	Canonical POST /sessions/{id}/messages. Both legacy paths unregistered.
R3	PUT /projects/:id aliased to PATCH	PATCH only. PUT not registered → 405.
R4	POST /projects/:id overloaded for repair	Canonical POST /projects/{id}/repair. Legacy unregistered.
R5	Degraded GET returns 200 with error field	Discriminator {project, status:"ok"|"degraded"}.
R6	Inconsistent ok/success flags	Drop on 2xx; return affected resource.
R7	GET /sessions/patches bespoke projection	Kept for parity; long-term sparse-fieldset candidate.
R8	POST /:id/kill|restore|remap RPC-style	Kept — state-machine commands, REST-justified.
R9	Bare {error: msg}	Locked envelope {error, code, message, requestId, details?}.

Locked decisions

• Error envelope: {error, code, message, requestId, details?} — replaces TS {error: string}.
• Compat strategy: legacy paths NOT registered. Mapping in handler comments + planned.legacy: [...]. Frontend repo migrates separately.
• Zod schemas → Go: ported to typed structs (TrackerConfig, SCMConfig, AgentConfig, ReactionConfig, LocalProjectConfig) with .passthrough() parity via Extra map. Lands in feat(api): 1b·a — Projects route shell (7 routes, REST-corrected) #20.
• OpenAPI spec + validation: deferred to follow-up feat(api): 1c — OpenAPI 3.1 spec + request/response validation #19 (consumes the planned bodies emitted by feat(api): 1b·a — Projects route shell (7 routes, REST-corrected) #20/feat(api): 1b — PR action route shell (merge + resolve-comments) #21/feat(api): 1b·c — Issues, PRs, runtime & remaining route shell #22).

Out of scope (across all three)

• Real handler logic — handler-impl phase.
• Reading TS config files / replicating Next-specific helpers (recordActivityEvent, revalidatePath).
• Updating the Next-side frontend to call canonical paths — separate PR in old orchestrator repo.

Owner: @neversettle17-101

[neversettle17-101]

Follow-up filed: #19 — OpenAPI 3.1 spec + request/response validation, builds on this PR's route shell and contract-preview stubs.