feat(api): publish the v1.43 contract with routes that answer 501 until filled

Every new endpoint of the contract exists, wrapped in apiHandler, with its
authentication, module gate and request validation, and answers
501 not_implemented until its behaviour lands. The OpenAPI document carries
the new operations and schemas and the additive response fields on the
changed routes. The four server feature flags are published as false.

contract-stub-inventory.test.ts registers the stubbed routes; each one
leaves the register with the change that fills it. The route, sharing,
session, security, module-gate and outcome inventories name the new routes
deliberately, and the error-code catalogue lists the codes the routes emit
today.

src/app/api/admin/maintenance/pulse-day-mean/route.ts

@@ -0,0 +1,39 @@
+/**
+ * `GET/POST /api/admin/maintenance/pulse-day-mean` — the pulse day-mean
+ * method (#1107 follow-up).
+ *
+ * GET answers the active method, when it was applied and the last dry run
+ * (status and result: per-account labels only, never an id). POST
+ * `{ action: "dry_run" | "apply" }` answers 202 `{ enqueued }`: a dry run
+ * computes both methods for every account and day and writes nothing but its
+ * result; `apply` needs a successful dry run from the last seven days (409
+ * `maintenance.pulseDayMean.dryRunRequired`), switches the method and
+ * rebuilds the pulse rollups. 409 `maintenance.pulseDayMean.busy` while a run
+ * is active. Admin only, cookie session only.
+ */
+import { NextRequest } from "next/server";
+
+import { apiHandler, requireAdmin } from "@/lib/api-handler";
+import { returnAllZodIssues, safeJson } from "@/lib/api-response";
+import { notImplemented } from "@/lib/http/not-implemented";
+import { pulseDayMeanActionSchema } from "@/lib/validations/pulse-day-mean";
+
+export const dynamic = "force-dynamic";
+
+export const GET = apiHandler(async () => {
+  await requireAdmin();
+  return notImplemented("admin.pulse_day_mean.get");
+});
+
+export const POST = apiHandler(async (request: NextRequest) => {
+  await requireAdmin();
+
+  const { data: body, error: jsonError } = await safeJson(request, {
+    maxBytes: 1024,
+  });
+  if (jsonError) return jsonError;
+  const parsed = pulseDayMeanActionSchema.safeParse(body);
+  if (!parsed.success) return returnAllZodIssues(parsed.error, 422);
+
+  return notImplemented("admin.pulse_day_mean.post");
+});

src/app/api/admin/support-report/route.ts

@@ -0,0 +1,17 @@
+/**
+ * `GET /api/admin/support-report` — a redacted plain-text report an operator
+ * can paste into an issue: build, database, configuration as yes/no, jobs,
+ * connections by health state, AI ledger and usage levels, notifications,
+ * backups and the most frequent recent error actions. Never an email address,
+ * a user id, a value, a token or a foreign host name; accounts appear as
+ * "Account 1..n". Admin only, cookie session only.
+ */
+import { apiHandler, requireAdmin } from "@/lib/api-handler";
+import { notImplemented } from "@/lib/http/not-implemented";
+
+export const dynamic = "force-dynamic";
+
+export const GET = apiHandler(async () => {
+  await requireAdmin();
+  return notImplemented("admin.support_report.get");
+});