feat(api): publish the v1.43 contract with routes that answer 501 until filled

Every new endpoint of the contract exists, wrapped in apiHandler, with its
authentication, module gate and request validation, and answers
501 not_implemented until its behaviour lands. The OpenAPI document carries
the new operations and schemas and the additive response fields on the
changed routes. The four server feature flags are published as false.

contract-stub-inventory.test.ts registers the stubbed routes; each one
leaves the register with the change that fills it. The route, sharing,
session, security, module-gate and outcome inventories name the new routes
deliberately, and the error-code catalogue lists the codes the routes emit
today.

src/app/api/environment/travel/suggestions/[id]/dismiss/route.ts

@@ -0,0 +1,23 @@
+/**
+ * `POST /api/environment/travel/suggestions/{id}/dismiss` — never suggest
+ * this run of travel days again. Answers `{ dismissed: true }`; 404
+ * `environment.travel_suggestion.not_found`. Part of the `environment`
+ * module; own account only.
+ */
+import { NextRequest } from "next/server";
+
+import { apiHandler, requireAuth } from "@/lib/api-handler";
+import { notImplemented } from "@/lib/http/not-implemented";
+import { requireModuleEnabled } from "@/lib/modules/gate";
+
+type RouteParams = { params: Promise<{ id: string }> };
+
+export const POST = apiHandler(
+  async (_request: NextRequest, { params }: RouteParams) => {
+    const { user } = await requireAuth();
+    await params;
+    const gate = await requireModuleEnabled(user.id, "environment");
+    if (!gate.enabled) return gate.response;
+    return notImplemented("environment.travel_suggestion.dismiss");
+  },
+);

src/app/api/environment/travel/suggestions/route.ts

@@ -0,0 +1,19 @@
+/**
+ * `GET /api/environment/travel/suggestions` — runs of consecutive Dawarich
+ * travel days no stored trip covers yet, as `{ id, startDate, endDate,
+ * countryCode }`. Accepting one goes through `POST /api/environment/travel`
+ * (the person picks the place); dismissing through the sibling route. Part of
+ * the `environment` module; own account only.
+ */
+import { apiHandler, requireAuth } from "@/lib/api-handler";
+import { notImplemented } from "@/lib/http/not-implemented";
+import { requireModuleEnabled } from "@/lib/modules/gate";
+
+export const dynamic = "force-dynamic";
+
+export const GET = apiHandler(async () => {
+  const { user } = await requireAuth();
+  const gate = await requireModuleEnabled(user.id, "environment");
+  if (!gate.enabled) return gate.response;
+  return notImplemented("environment.travel_suggestions.get");
+});