Stage 2 AI surface: AI task CRUD, the worker contract (discover tasks, pull the latest sampled
frame, post detections/events back), sampler status, and a detections query.
Assemble the kernel API router (absolute paths, mounted at root by the composing server). The
auth admin surface stays here for now; domain apps (Campus Entry, …) merge their own routers in
the server binary.