pub fn api_router() -> Router<AppState>
Assemble the kernel API router (absolute paths, mounted at root by the composing server). The auth admin surface stays here for now; domain apps merge their own routers in the server binary.