feat(api): 1b·c — Issues, PRs, runtime & remaining route shell #22

Part of #10 — Go HTTP Daemon lane. Sub-issue of umbrella #18.

⚠️ Scope: Placeholder. Register the remaining ~12 routes as 501 Not Implemented with structured planned bodies. Final route count + REST audit pending a TS-source read pass; opening this issue now to track scope.

Depends on

• feat(api): 1b·a — Projects route shell (7 routes, REST-corrected) #20 (#18a Projects) and feat(api): 1b — PR action route shell (merge + resolve-comments) #21 (#18b Sessions) for shared scaffolding.

Tentative route list (subject to TS audit)

• GET /api/v1/issues — list issues
• GET /api/v1/backlog
• POST /api/v1/prs/{id}/merge
• GET /api/v1/runtime/terminal (no-op; phase 4)
• GET /api/v1/observability
• GET /api/v1/orchestrators
• GET /api/v1/version
• GET /api/v1/verify
• POST /api/v1/update
• POST /api/v1/setup-labels
• POST /api/v1/webhooks/* (wildcard)
• GET /api/v1/filesystem/browse
• GET /api/v1/events (SSE placeholder; phase 2)
• GET /mux (placeholder; phase 4) — mounted outside /api/v1

Each will get the same REST audit treatment as #20 / #21 once the TS source is read. Expected fixes:

• Errors → locked envelope {error, code, message, requestId}.
• Inconsistent success flags dropped.
• Legacy paths documented via planned.legacy, not registered.

Exit criteria

All remaining routes return 501 + planned envelope. GET /mux and GET /api/v1/events skip the REST-timeout group (long-lived / streaming).

Closes part of #18.