Defer the JSON API until something consumes it

Supersedes decision 17, which expected endpoints to appear one at a time.
Nothing calls /api at all, so even that would be handlers with no callers and
golden tests guarding shapes nothing reads.

The contract stays in the spec as a design — it is what stops the shape
changing under a future client — marked as not built so the spec doesn't
claim behaviour the code lacks. later.md records what to build first when a
consumer appears.

docs/spec.md

@@ -509,8 +509,10 @@ file.
 
 ## 8. API contract
 
-Fixed before implementation, because the shape is the expensive thing to change once a client is
-installed somewhere you cannot update.
+**Not built.** Nothing consumes `/api` — the browser talks HTML to the page surface — so this
+section is a design, not a description of running code (decision 43). It stays here because the
+shape is the expensive thing to change once a client is installed somewhere you cannot update, and
+the first endpoint is one line over a data function that already exists.
 
 **Conventions**
 
@@ -727,4 +729,4 @@ panel, so the admin surface comes first — before a single member can exist.
    this step.**
 5. **YouTube path** — yt-dlp metadata and download, slotted into a pipeline that already works.
 6. **Stats, profiles, avatars, palaute.**
-7. **API endpoints and golden tests**, once something wants them.
+7. **API endpoints and golden tests** — deferred until something wants them (decision 43).