feat(api): publish the v1.43 contract with routes that answer 501 until filled

Every new endpoint of the contract exists, wrapped in apiHandler, with its
authentication, module gate and request validation, and answers
501 not_implemented until its behaviour lands. The OpenAPI document carries
the new operations and schemas and the additive response fields on the
changed routes. The four server feature flags are published as false.

contract-stub-inventory.test.ts registers the stubbed routes; each one
leaves the register with the change that fills it. The route, sharing,
session, security, module-gate and outcome inventories name the new routes
deliberately, and the error-code catalogue lists the codes the routes emit
today.

src/app/api/nutrients/catalog/route.ts

@@ -0,0 +1,22 @@
+/**
+ * `GET /api/nutrients/catalog` — the nutrient catalogue as the forms use it.
+ *
+ * One entry per code: canonical unit, label in the account's language,
+ * whether HealthKit may send it (`syncable`), the input units with their
+ * factor to the canonical unit, and the tolerable upper intake level with its
+ * scope and source (or null). Clients build the composition form from this
+ * and never convert units themselves.
+ */
+import { apiHandler, requireRecordAuth } from "@/lib/api-handler";
+import { notImplemented } from "@/lib/http/not-implemented";
+import { requireModuleEnabled } from "@/lib/modules/gate";
+
+export const dynamic = "force-dynamic";
+
+export const GET = apiHandler(async () => {
+  const { user } = await requireRecordAuth("read", "measurements");
+  const gate = await requireModuleEnabled(user.id, "nutrients");
+  if (!gate.enabled) return gate.response;
+
+  return notImplemented("nutrients.catalog.get");
+});