Well-known discovery routes

Machine-readable public surfaces:

• /.well-known/api-catalog
• /.well-known/ai-access.json
• /.well-known/mcp.json and /.well-known/mcp/server-card.json
• /.well-known/security.txt

Keep route paths and response documents stable for discovery clients, crawlers, and automation.