docs(tasks): decompose review-002 into 24 tasks (23 implementation + 1 bracketed follow-up)

Decomposition of docs/reviews/002-post-remediation-review.md per its
5-unit remediation plan:

- Unit 1 (security-critical): gw15-publish-body-cap,
  prj16-schema-via-call (CF-004 filed alkcall-side), fwd13-dot-segments,
  fwd16-missing-capability, oai11-ref-memoization
- Unit 2 (timeout/terminality): ws13-idle-progress,
  fwd15-stream-timeout, cli01-retry-after-budget, con17-mcp-pagination,
  con18-wss-sweep-exit
- Unit 3 (projection/docs): projection-truthfulness, mcp-batch-cap,
  gw16-status-drift
- Unit 4 (spec-import): yaml-normalization, oai13-path-item-wildcards,
  import-loudness-cluster, js01-placeholder-check,
  fwd17-19-contract-decisions
- Unit 5 (WS polish + tests): con18b-ws-polish,
  client-policy-wire-tests, cov-deployment-knobs, cov13-dead-code,
  srv11-srv12-router-ordering
- review-002-bracketed-followup: tentatively planned post-bulk pass
  (stale-check, OQA-18 enforcement decision, CON-08/09 close() lever,
  cross-crate re-checks) — deliberately not serialized against the
  bulk

Also: review-002 numbering repair (CON-14 was double-booked; MCP
pagination now CON-14, from_wss monitor renumbered CON-18, missing
CON-14 section added).

taskgraph: 66 valid, no cycles; 24 pending (all review-002);
gen-1/gen-2 parallel waves identified; workflow-cost hotspots are
prj16 (12.8) and ws13 (11.1), both carrying the reviewed slicing
guidance in their Notes.

tasks/server/review-002-srv11-srv12-router-ordering.md

@@ -0,0 +1,67 @@
+---
+id: review-002-srv11-srv12-router-ordering
+name: Router-layering fixes — double token resolution on WS and mcp, decoy 405 on extra routes (SRV-11, SRV-12)
+status: pending
+depends_on: []
+scope: narrow
+risk: medium
+impact: component
+level: implementation
+tags: [server, review-002, stealth]
+---
+
+## Description
+
+Two review-002 findings in `server/adapter.rs`'s `build_router` — both
+are axum `route_layer`/merge-ordering semantics (empirically verified
+in review 002 with an axum 0.8.9 harness; `route_layer` wraps routes
+registered *before* the call):
+
+- **SRV-11**: the router-wide `bearer_auth_middleware` layer (:328)
+  wraps the WS route (registered earlier at :307-317 with its own
+  `ws_bearer_auth`) and the `/mcp` nest (own layer at :288-292) — the
+  token resolves **twice** on both, and the code comment claims the
+  opposite ("resolves the token exactly once"). Benign today
+  (ag stashes agree), but a provider with token-use side effects
+  double-counts.
+- **SRV-12**: `method_not_allowed_fallback(decoy_method_not_allowed)`
+  (:322) covers only routers registered before the extras merge —
+  wrong-method probes on **extra routes** return axum's bare 405 (no
+  body, no `Server: nginx`), the exact stealth probe SRV-07's fix
+  neutralized for the default surface.
+
+## Acceptance Criteria
+
+- [ ] SRV-11: the WS route resolves the token exactly once (drop the
+      router-wide layer's application to it — e.g. verify with an
+      axum-semantics-confirmed mechanism: register the WS route after
+      the route_layer call, or exclude via per-route wrapping) and
+      `/mcp` likewise (keep exactly one auth layer for it); the
+      corrected comment states axum's actual `route_layer` semantics
+- [ ] SRV-11 test: a counting IdentityProvider — one WS upgrade
+      request resolves the token exactly once (and one `/mcp` request
+      likewise, feature-gated)
+- [ ] SRV-12: `method_not_allowed_fallback(decoy_method_not_allowed)`
+      re-applied after the extras merge; test: wrong-method probe on
+      an extra route carries the decoy body + `Server: nginx` header
+- [ ] Re-verify the existing router tests (extra-routes auth, decoy
+      405 default-surface, reserved-path panics) still pass — the
+      merge-order changes must not regress SRV-01's guarantee
+- [ ] `cargo test`, `cargo clippy --all-targets -- -D warnings`,
+      `cargo fmt --check` pass
+
+## References
+
+- docs/reviews/002-post-remediation-review.md (Part A', SRV-11, SRV-12; hot-spot 2 in the server pass)
+- src/server/adapter.rs:274-345 (build_router), :296-320 (comment + WS route), :322 (405 fallback), :328 (router-wide layer)
+- tasks/server/review-001-extra-routes-auth.md (the SRV-01 ordering this must preserve), tasks/server/review-001-hyper-server-knobs.md (SRV-07's decoy-405 work)
+
+## Notes
+
+Order-sensitivity warning (from the server pass): "any future route
+addition must re-derive these semantics empirically" — after fixing,
+add the counting test + the extra-route 405 test so the invariants are
+pinned, not just commented. The SRV-01 opt-out shape (inner layers
+win) must remain exactly as tested. Keep the SRV-10 fold-in fix
+(historical) intact — this task is about the *comment* being false and
+the double-resolve being real.