Function enforce_api_surface 

async fn enforce_api_surface(req: Request, next: Next) -> Response

Outer guard for the API listener. Rejects any path outside the API surface with 404 Not Found before it can reach a handler (and before auth side effects). Reachability is kept separate from authentication.