docs(api): publish the share link's PDF and FHIR downloads

Both routes were exempt from the contract as `shareLink` — "authenticated
by the URL credential, for a recipient with no account". That reason
holds for the page a person opens. It does not hold for two routes whose
whole purpose is to hand a practice a file it files into another system,
which is exactly the audience a contract has. `/c/{token}/d/{id}` was
published all along, one route away in the same tree.

Each entry states the gate it shares with the page, the frozen selection
it can never exceed, the flat 404 that covers every miss class including
a documents-only link, and the 20/h per-link bucket. The FHIR entry says
plainly that it is a download and not a REST face, and names the two
resource families the bundle deliberately omits.

The create-request description claimed "there is no FHIR or other
machine-readable face behind a share token", which stopped being true
when these routes landed. It now describes what a link actually serves
and records that the insurance leaf is refused outright.

The coverage guard gains the other half of its staleness check. It caught
an exemption for a route that had disappeared, and never the reverse — an
exemption left behind after the route was published, which is how these
two would have stayed on the list while the contract already carried
them. Break-proof: re-add either entry and it goes red naming it.

src/__tests__/openapi-route-coverage-guard.test.ts

@@ -336,8 +336,14 @@ const UNPUBLISHED: Readonly<Record<string, Exemption>> = {
     kind: "providerWebhook",
     methods: ["GET", "POST"],
   },
-  "/c/{token}/fhir": { kind: "shareLink", methods: ["GET"] },
-  "/c/{token}/report.pdf": { kind: "shareLink", methods: ["GET"] },
+  // `/c/{token}/report.pdf` and `/c/{token}/fhir` were exempt here as
+  // `shareLink` and are published now. That reason holds for the page a
+  // recipient opens; it does not hold for two routes that serve machine
+  // formats a practice files into another system, which is precisely the
+  // audience a contract has. `/c/{token}/d/{id}` was published all along, one
+  // route away in the same tree, which is what makes the exemption read as an
+  // oversight rather than a decision. The `shareLink` reason stays: the next
+  // recipient-facing route is likelier to want it than not.
   "/.well-known/apple-app-site-association": {
     kind: "wellKnown",
     methods: ["GET"],
@@ -462,6 +468,29 @@ describe("every route is published, unpublished, or retired", () => {
     ).toEqual([]);
   });
 
+  it("the exemption list names routes that are not published after all", () => {
+    // The other way an entry goes stale, and the one this list had: a route
+    // gets published and its exemption stays behind, so the list reads as
+    // larger than it is and the reason attached to it looks load-bearing when
+    // nothing rests on it. Two share-link routes sat here in exactly that
+    // state, beside a published sibling in the same tree.
+    const table = openApiPaths as Record<string, Record<string, unknown>>;
+    const redundant: string[] = [];
+
+    for (const [path, exempt] of Object.entries(UNPUBLISHED)) {
+      for (const method of exempt.methods) {
+        if (method.toLowerCase() in (table[path] ?? {})) {
+          redundant.push(`${method} ${path}`);
+        }
+      }
+    }
+
+    expect(
+      redundant,
+      "these operations are published AND exempt, so the exemption states a reason nothing depends on",
+    ).toEqual([]);
+  });
+
   it("the contract does not publish a path that no route serves, unless it is retired", () => {
     const byPath = new Set(disk.map((route) => route.path));
     const phantom = Object.keys(openApiPaths).filter(