API route test coverage and dogfood hygiene

Continued overnight hardening on the public REST surface:

• Thin Vitest mirrors for health, readiness, OpenAPI, set_post_tags, create_survey, survey GET/PATCH, incident updates, domains/CI, and more write paths
• Dogfood hygiene comments clarifying FTS vs pgvector, Teams webhook vs App Store, and PITR runbook vs live restore drills

Product features remain infra-gated where noted in the backlog (Stripe, SAML, embeddings key, Teams App Store, live Twilio WA/voice).