test(backend): assert API schema behavior over HTTP

[EmmanuelAdesina]

Summary

• Replace app.routes path inspection with HTTP behavior checks for withheld and opted-in API schema paths.
• Verify /health and /health/ready remain HTTP 200 when the schema is withheld without running app lifespan; health dependency behavior remains covered by existing health endpoint tests.

Verification

• cd backend && python -m pytest tests/unit/test_api_schema_exposure.py -q — 14 passed.

No deploy, smoke-test, audit-gate, or rollback scripts changed.