feat(GAT-9591): port the JSON API resource routes

[calmacx]

What

Ports the twelve JSON API resource routes into app/routes/api/ byte-identical to poc/GAT-XXXX and registers them in app/routes.ts: /translate, /validate, /find, /list/{schemas,templates,translations,datasets}, /get/{schema,map,form_hydration,dataset} and /openapi.json.

Why

These are the live contracts Gateway API, gateway-web-2 and the federation service call today. They land together because all twelve depend only on the ported engine, and because the spec endpoint enumerates its siblings.

Testing

npm run typecheck, npm run lint, npm run build all exit 0; the server bundle jumps from 5 kB to 69 kB, which is the first real exercise of Vite's ssr.external handling for the CJS-only packages. The /openapi.json fix was verified inside a built production image (docker exec … ls /app/app → no such directory, confirming the defect; spec then served with all paths present).

Notes

• Also fixes /openapi.json in production. The loader globbed app/routes/api/*.ts at runtime, but Dockerfile.prod's final stage does not copy app/, so the glob matched nothing and the spec shipped with zero paths. Local runs and CI could never see it, because there the repo is the working directory. The spec is now compiled at build time; the generator exits non-zero rather than writing an empty spec, so it cannot fail silently again.
• The @openapi JSDoc annotations are untouched — they are the generator's input, not commentary.
• Replaying production fixtures against this branch surfaced five contract divergences. They are fixed in the PR stacked directly on this one, so that this stays reviewable as a verbatim port.

[gh-actions-pipelines-app]

🎉 Great job! Your PR title follows the correct format. 🚀

[calmacx]

Scope expanded 2026-09-21 — this PR now also carries the API contract fixes that were #129.

#129 existed only because this PR was already open when the divergences were found, and its rationale was the production fixture replay, which has been removed from the repo. It is closed; its single commit is now fix(GAT-9591): restore API contract parity with production on this branch.

That commit restores five behaviours the port had dropped relative to production:

• GET /status — was missing entirely (404 where production responded); likely a liveness-probe target
• POST /translate — the express-validator errors[] envelope that gateway-web reads
• POST /translate — validation of validate_input / validate_output (0/false and 1/true accepted, anything else an error) and the type check on extra
• GET /get/map — 200 where the port had started returning 400
• GET /get/map — additive translation_path / translation_maps so a pair with no direct map exposes the chain TRASER would apply

Route count is 11, not the 10 this PR originally landed — /status is the eleventh.

The title still says "port the JSON API resource routes"; gh pr edit is currently failing against this repo with a Projects-classic GraphQL deprecation error, so it needs editing by hand if the wording matters.