AUTH4D-1 API surface

• GET /health returns a non-authentication health response.
• Tenant (/t/*), OAuth (/oauth/*), device (/device/*), management (/management/*), and console backend (/api/*) operations are placeholders and return 501 Not Implemented.
• The API and console may serve their static application assets through Workers Static Assets.

This fragment records the initial skeleton only. Feature tickets own their own API-spec fragments.