refactor(api): move query-engine to a private internal tier

[Makisuo]

What

Moves the queryEngine group off the public /api/* surface onto its own HttpApi (MapleInternalApi) at /internal/query-engine, behind session-only auth, and deletes four endpoints that already had zero traffic.

Why

queryEngine was the largest and busiest thing left on the public surface — 62 endpoints, ~4,500 req/week, more than every other /api/* group combined — and /docs published all of them as a browsable public API reference.

It isn't public API. Using the maple.auth.method attribute stamped on every HTTP server span, across 30 days and all 62 endpoints production recorded exactly one API-key request (errors-by-type, 1 call). Everything else is a Clerk session.

That matters beyond hygiene: docs/http-api-migration.md already forbids a generic public query endpoint, because those contracts freeze our storage and dashboard internals into the public API. docs/api-v2.md had long declared the intended end state; this makes it true.

The design call

"Internal tier" reads as Effect RpcServer on /rpc. I deliberately didn't do that — apps/api/src/worker.ts documents that POST /mcp, the one existing RpcServer-backed route, hangs indefinitely on Workers when toWebHandler gets no middleware, attributed to a suspected RpcServer/HttpRouter scope-propagation bug. Putting the busiest surface in the product on that transport buys the same guarantee for a 62-endpoint rewrite plus a known Workers hang.

So the boundary is policy, not protocol. The typed contract, AtomHttpApi retention, the execute batcher and the v1 error envelope are all unchanged — the frontend behaves exactly as before. Being a separate HttpApi is what drops the group from /docs, which is generated from MapleApi.

Notable details

• SessionAuthorization rejects on the maple_ak_ prefix, not by resolving the key. A refused key therefore costs no Postgres dial on the busiest path in the API — worth having, since the p95 there is the PG dial. The refusal is a typed 403 pointing at /v2; a bare 401 would read as "your key is broken" and send someone to rotate a key that's fine.

• Four endpoints deleted after reaching zero traffic:

  • execute — superseded by the batcher in dc21b94. It has no single-request fallback at any batch size, so nothing called it.
  • service-dependencies / service-db-edges / service-platforms — superseded by serviceMapBundle in a3128de, which runs the same registry queries in-process.

  QueryEngineService.execute stays — the batch fan-out, serviceDetailOverview and six v2 telemetry handlers still call it in-process.

• runWarehouseQuery now accepts either v1 client and provides both layers. It's shared with the session-replay adapters, which are still on /api; a blanket swap broke them. It narrows again when sessionReplays moves.

• Handler moved from routes/v1/ to routes/internal/ so the directory stops lying.

Verification

Check	Result
bun typecheck	40/40 tasks pass
apps/api tests	1757 passed
apps/web tests	1537 passed
packages/domain tests	489 passed
bun run knip	exit 0
Route introspection	MapleInternalApi = 58 endpoints, all under /internal/query-engine, zero stray; MapleApi = 118, zero query-engine

The last row is the one that matters — a wrong prefix or broken registration would leave typecheck green while 404ing every chart, so I introspected the built API directly rather than trusting the compiler.

Not verified — please exercise before merge

I did not run the browser pass. Outstanding at runtime:

1. An API key against /internal/query-engine/execute-batch returns the typed 403 (and a session returns 200).
2. The dashboard renders end to end — service detail, trace list, a multi-widget dashboard, logs.
3. /docs no longer lists any query-engine operation.

Since sessions loaded before deploy keep calling /api/query-engine/* until reload, expect a burst of 404s in open tabs at cutover. If that's unacceptable, serve both prefixes from the same handler layer for one release and drop the old one next release — the plan allowed for it; this PR does the direct cutover.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}