docs: api-coverage.md omits shipped routes and needs a re-score pass #109

Split out of the 2026-09-17 doc sync (PR #108), which corrected work-consolidation.md but deliberately left this file alone.

The gap

docs/api-coverage.md omits rows entirely for routes the client now builds and ships:

Some of these have been shipped for weeks. A coverage matrix that does not list a route the client calls is worse than one that lists it as unbuilt — it reads as "not in the API" rather than "not scored".

Why it was not fixed in passing

The file maintains arithmetic invariants: per-section subtotals and a grand total, both stated in prose and already corrected once for an off-by-thirty slip (footnote 14, and the 2026-09-05 entry). Adding rows without recomputing those makes the document internally inconsistent, which is a worse failure than the omission.

It also has a maintenance rule governing when Implemented / Tested may flip — a tested App-layer view model has to drive the row end-to-end. Several of the routes above now qualify, and several do not, and deciding that per row is the actual work.

Also worth re-scoring while in there

The 2026-09-14 pass explicitly did not re-score Implemented/Tested — it only derived the Auth column from the live spec. Since then PRs #86–#107 shipped a great deal, so the scored state is stale in both directions: rows marked ☐ that now have end-to-end tests, and rows whose method or path changed under them (the list-schema family in #85, the notification routes in #95).

Acceptance

• Every route the client builds has a row.
• Section subtotals and the grand total are recomputed from the rows themselves, not carried forward.
• Implemented/Tested re-scored under the file's existing rule, with the wave's PRs cited per flipped row.
• The Auth column stays derived from x-auth-type, and any row whose auth annotation was corrected this wave (/api/user/identities → Bearer, PR feat(settings): the Integrations surface — and three live identity defects underneath it (G33) #93) reflects it.