chore(api): enforce sebuf contract + migrate drifting endpoints (#3207)

.github/CODEOWNERS

@@ -0,0 +1,6 @@
+# Adding or modifying api-route-exceptions.json opts an endpoint out of the
+# sebuf contract. Every change here needs review to prevent drift.
+/api/api-route-exceptions.json @SebastienMelki
+
+# The enforcement script and its CI wiring are the teeth behind the manifest.
+/scripts/enforce-sebuf-api-contract.mjs @SebastienMelki

.github/workflows/lint-code.yml

@@ -43,6 +43,7 @@ jobs:
       - run: npm run lint:unicode
       - run: npm run lint
       - run: npm run lint:boundaries
+      - run: npm run lint:api-contract
       - name: Markdown lint
         run: npm run lint:md
       - name: Version sync check

.husky/pre-push

@@ -65,6 +65,9 @@ node scripts/check-unicode-safety.mjs || exit 1
 echo "Running architectural boundary check..."
 npm run lint:boundaries || exit 1
 
+echo "Running rate-limit policy coverage check..."
+npm run lint:rate-limit-policies || exit 1
+
 echo "Running edge function bundle check..."
 while IFS= read -r f; do
   npx esbuild "$f" --bundle --format=esm --platform=browser --outfile=/dev/null 2>/dev/null || {