fix(api): sanitize batch gather escapes, admin-route authz walk, production docs gate (audit G-5, G-4, G-2)

[brownjuly2003-code]

Closes the three code findings from the 2026-07-20 deep audit.

G-5 (P3, S-2 residual): /v1/batch's gather fallback echoed str(outcome) to the client for any non-BatchResult outcome — the one error path that bypassed _safe_item_error. New _unexpected_outcome_error logs the raw text server-side under the correlation id and returns a generic batch item failed (ref ...). Unit test injects an exception carrying a fake DSN and asserts none of it reaches the response.

G-4 (P3, latent): admin paths skip the auth middleware by design, so a future /v1/admin router registered without Depends(require_admin_key) would ship fully open — the existing matrix test only pins the two known router objects. Added a walk over the assembled app flagging any admin-matching route (incl. mounts) without the dependency, plus a probe test that proves the checker can fail (mutation-verified locally: stripping the dependency from admin.py turns the walk red). No runtime change.

G-2 (P3): /docs, /redoc, /openapi* are auth-exempt, which on a production deploy hands any caller the full route map without a key. New production_docs_guard middleware 404s them when app.state.profile == "production" — same policy shape as the CORS-wildcard refusal (P2-3); demo/dev unchanged. OpenAPI schema itself is untouched (no route changes).

Local: ruff check/format clean; 128 tests green across the touched surfaces (batch, admin authz matrix, docs gate, openapi auth surface, CORS, api metrics, auth fail-closed, export-openapi, production boot gate).

🤖 Generated with Claude Code

[github-actions]

DORA Metrics

• Window: last 30 days
• Branch: main
• Deployment frequency: 118 total / 27.53 per week
• Lead time for changes: avg 0.83h / median 0.0h
• Change failure rate: 77.12% (91/118)
• MTTR: 20.13h across 5 incident(s)