docs(tasks): decompose review 001 remediation Units 1-5 into taskgraph tasks

21 review-001 tasks across server/adapters/client/gateway/websocket/infra,
chunked from the 7-unit remediation plan in
docs/reviews/001-initial-implementation-review.md.

- Scope split by mechanism, not one-per-finding: 15 tasks in generation 1
  (parallelizable), 6 sequenced after their file-sharing precursors
- Deliberately deferred until dependent fixes land: projection/doc
  fidelity partial (Unit 6 beyond dependency hygiene), coverage backfills
  (COV-01..07 via in-task acceptance for forward.rs), and per-finding
  minors (OAI-06/07, HY-02/04/06/10/11, CON-08)
- Cross-crate WS-12 (alkcall demux 4 GiB discard alloc) noted for filing
  in alkcall, not here

taskgraph: validate clean, no cycles, 6 generations

tasks/server/review-001-extra-routes-auth.md

@@ -0,0 +1,52 @@
+---
+id: review-001-extra-routes-auth
+name: Mount extra_routes under the bearer-auth middleware (SRV-01)
+status: pending
+depends_on: []
+scope: narrow
+risk: medium
+impact: component
+level: implementation
+tags: [server, review-001, security]
+---
+
+## Description
+
+Review 001 finding SRV-01 (`docs/reviews/001-initial-implementation-review.md`,
+empirically verified): `build_router`
+(`src/server/adapter.rs:170-183`) applies `bearer_auth_middleware` via
+`route_layer` **before** merging `extra_routes`, so assembly-layer custom
+routes are mounted without auth — contradicting ADR-046 §4 ("custom routes
+carry the same auth middleware by default"). Amplified by
+`ResolvedIdentity` extraction being infallible: a custom handler silently
+receives `None` on every request.
+
+Fix: apply the auth layer **after** merging extra routes so the documented
+default holds. Per-route opt-out remains the deployment's explicit choice
+(extras may carry their own inner layers). Also decide and document the
+SRV-06 interaction: a same-method collision on a reserved path panics in
+axum's `merge` (sanctioned), but a different-method merge (e.g. custom
+`POST /search`) silently serves on a reserved path — enforce
+`RESERVED_PATHS` or document the behavior; the exported constant currently
+has no reader.
+
+## Acceptance Criteria
+
+- [ ] A test mounts an extra route and asserts `ResolvedIdentity` is resolved from the bearer token (auth applies)
+- [ ] A test shows an extra route carrying its own layer can still opt out (documented escape hatch)
+- [ ] SRV-06 decision landed: per-method reserved-path merges rejected/documented; `RESERVED_PATHS` enforced or un-exported
+- [ ] ADR-046 §4 language matches the implemented default after the fix
+- [ ] `cargo test` and `cargo clippy --all-targets -- -D warnings` pass
+
+## References
+
+- docs/reviews/001-initial-implementation-review.md (Part A, SRV-01, SRV-06)
+- docs/architecture/decisions/046-assembly-layer-custom-http-routes.md
+
+## Notes
+
+> Agent fills during implementation.
+
+## Summary
+
+> Filled on completion.