Stage 2 AI surface: AI task CRUD, the worker contract (discover tasks, pull the latest sampled
frame, post detections/events back), sampler status, and a detections query.
Fleet outbox foundation (open-core seam, Stage 0): the appliance-side read API over the durable,
ordered transactional outbox (outbox table) plus a tiny unauthenticated site-identity endpoint.
Assemble the kernel API router (absolute paths, mounted at root by the composing server). The
auth admin surface stays here for now; domain apps merge their own routers in
the server binary.