feat(api): give every operation a stable operationId and real tags

The document emitted tags: [] on all 244 operations and an operationId on none,
which collapses every one of them into a single flat namespace for a generated
client or a doc explorer -- and makes every path edit a breaking rename, since
the id would otherwise be slugified from method+path.

126 literal registerPath calls carry both inline. The five families registered
from a table derive them in-loop from the same rules, because those tables exist
so that adding a sibling route is a one-line change and a second hand-written
entry per route would give that up.

All 244 now carry both, with no duplicate ids. That is the precondition for
deleting isProtectedPath/applySecurityMetadata: the parallel security model can
only go once every operation declares enough to derive its own stanza.

Author: JSONbored