Well-known discovery routes

• Preserve stable paths and machine-readable response contracts for api-catalog, ai-access.json, mcp.json, the MCP server card, and security.txt.
• Discovery documents must stay aligned with their runtime routes and MCP surface.

Verification

pnpm --filter website test