#1020 Statistics routes have no permission check; query route leaks a DB connection per call and answers 200 for missing runs

Found during #1012. (1) GET /workflows/stats, /workflows/<id>/metrics, /workflows/heatmap carry @spec.validate but no @require_permission (tenant scoping only). (2) api/blueprints/v1/queries.py get_query_service() opens db_manager.create_direct_connection(autocommit=True) per request and never closes it. (3) GET /workflows/<missing-uuid>/query returns 200 {'error': 'Workflow not found'} (live, tenant test, 2026-10-20). (4) spectree response validation turns error bodies that do not match the declared ErrorResponse into 500 + a pydantic error list (live: /schedules/<missing> before #1012; /analytics/queues?tenant_id=<unknown> returns 500 pydantic list for a permission-check failure). Sweep remaining jsonify({'error': str}) returns on routes that declare ErrorResponse.