#931 Bloat review: classify all API routes core/keep/remove; app-system extension design

EARS SPEC: - Every API route shall be classified core/keep/remove with a reason, and removals shall be coordinated with dashboard and highway-mcp owners. Parent epic: #913. Synthesis (technical problems / solution domains / alternatives) recorded as a comment when started.