chore(auth): identify observer route families

[bokelley]

Rollout purpose

Follow-up to #6841, #6855, and #6827. Runtime shadow logs can currently identify a missing explicit organization selector but cannot identify the affected route family. This adds a coarse, fixed-allowlist route_family field so stop-gate observations are actionable.

Safety

• Observe-only: no authorization, persistence, or response behavior changes.
• Runtime logs still contain no paths, credential IDs, identity IDs, emails, or organization IDs.
• Only fixed top-level API family constants can be emitted; dynamic and unknown segments become other.
• Existing observer kill switch, timeout, and concurrency cap are unchanged.

Verification

• Observer unit suite: 7/7 passed.
• TypeScript no-emit build passed.
• Diff check passed.
• Commit hook was skipped because the repository-wide local pre-commit is known to hit the C2PA native-binary/timeout issue; clean GitHub CI is the merge gate.

[aao-secretariat]

Ladon verdict: Approve

Approve — server-only observe-only telemetry addition; no blocking findings.

This PR adds a route_family field to the identifier-free org-authorization shadow log, derived from a fixed allowlist reducer (authorizationRouteFamily). It touches only server middleware and its unit test — no schema (static/schemas/source/**), no docs, no changeset surface, no wire shape, no released dist/** artifact, and no migration. None of the spec-governance hard gates apply.

Medium findings

• server/src/middleware/organization-authorization-observer.ts:145 — Route-family allowlist is a plain object literal, so prototype-inherited keys (toString, constructor, __proto__, etc.) defeat the fallback and can break the reducer's allowlist invariant. Worth a follow-up (use Object.create(null), Object.hasOwn, or a Map), but it's confined to non-load-bearing telemetry and does not corrupt durable state.

Decision-table walk: no critical/high findings (row 1 n/a); gated_paths false (row 2 n/a); high_risk false (rows 3/5 n/a); the single medium is not data-loss/schema/infra (row 4 n/a); no prior escalation (row 6 n/a); no no-auto-approve team match (row 7 n/a); only 1 medium finding, fewer than 3 (row 8 n/a). Falls through to row 9 → approve. review_decision: REVIEW_REQUIRED does not block because gated_paths is false.

Medium findings

• server/src/middleware/organization-authorization-observer.ts:145 — Route-family allowlist lookup inherits from Object.prototype

[aao-secretariat]

Ladon verdict: Approve

Approve — prior Medium finding resolved, no current findings.

This is a subsequent review. The prior run flagged one medium finding (organization-authorization-observer.ts:145 — route-family allowlist lookup inheriting from Object.prototype). This push resolves it: authorizationRouteFamily now guards the lookup with Object.prototype.hasOwnProperty.call against a frozen SAFE_ROUTE_FAMILIES, so inherited keys (toString, proto, constructor) correctly resolve to 'other'. New tests cover the prototype-key cases and assert route_family in the shadow-observation log, and the route regex isolates the first /api/ segment while stripping query/fragment to preserve the identifier-free log contract.

No new findings. No blocking issues. Not high-risk, no gated paths, no team gate. Net improvement over the prior review — falls through to row 9.