docs: resolve documentation audit findings for 2026-04-10

[j-shilling]

Summary

• generate a dated documentation audit report at docs/audit/2026-04-10_11:50:01.md
• fix runtime/setup/docs drift around live routes, auth wiring, OpenAPI workflow commands, and the versioned contract path in AGENTS.md
• refresh feature docs that still described removed or unwired behavior

What remains unresolved

• the checked-in public contract still documents bearer-token auth, but the current runtime branch does not wire a bearer/Cognito verifier in api.New
• older historical audit reports remain in docs/audit/ and still describe earlier branch states

Validation

• pnpm exec markdownlint-cli2 README.md AGENTS.md api-spec/README.md docs/api.md docs/architecture.md docs/features/README.md docs/features/core/nsc-education.md docs/features/security/cognito-auth.md docs/overview.md docs/planning/public-api-data-model-design-first.md docs/setup.md docs/audit/2026-04-10_11:50:01.md
• secret-pattern scan with rg returned no matches outside archived audit reports
• local markdown link-path check across the edited docs returned no missing file targets