HTTP entity endpoints — top-level commissioning story

Three libs + an exe: api (Boost.Beast server, router=/=route_builder, request/response value types, OpenAPI endpoint_registry), core (the route modules iam_routes, risk_routes [currencies], variability_routes, assets_routes, storage_routes), server (the application=/=host, config parser, main, and a NATS discovery-only registrar). Entry: server/src/main.cpp:60 → host::execute → application::run.

• Routes are lumped by domain, not per entity. risk_routes owns currencies; iam_routes owns auth+accounts+roles. Each module is a class with register_routes(router, registry) + handler methods, instantiated and wired by hand in application.cpp:153-167. That hand-wiring is the blob.
• Handlers call domain services IN-PROCESS, not over NATS. e.g. refdata::service::currency_service service(ctx_); service.list_currencies(...) (core/src/routes/risk_routes.cpp:114-115), serialised with rfl::json. So country routes will call refdata::service::country_service directly (it already exposes list/get/save/delete/history). No NATS round-trip.
• Route declaration (risk_routes.cpp:44-57): router->get("/api/v1/currencies").summary(...).auth_required().query_param(...).response<get_currencies_response>().handler(...), then BOTH router->add_route(built) and registry->register_route(built) (OpenAPI is a separate registry — forget it and the route is invisible in /openapi.json).
• Auth is a single session-level choke point: api/src/net/http_session.cpp:138-191 validates the Bearer token when route.requires_auth, stores claims in authenticated_user, then checks required_roles.

• CRITICAL — algorithm mismatch. The HTTP server signs HS256 with a local secret (api/src/net/http_server.cpp:41-45; RS256-from-file is a // TODO stub at :48-49), while the entire rest of the fleet verifies RS256 against the signing service's public key (request_context.cpp:46-48, the domain/Wt runners). HTTP-minted tokens fail verification everywhere else; only masked today because HTTP handlers call services in-process and never present the token over NATS.
• Tenant identity not propagated. handle_login computes tenant id/name but never sets claims.tenant_id (iam_routes.cpp:537-543), though create_token=/=validate support it and downstream reads it. Authenticated requests lose tenant scoping → entity routes operate on ctx_'s tenant, not the caller's.
• Fails open if the authenticator is unconfigured (http_session.cpp:150: validation only runs inside if (is_configured())).
• 100-year leeway validator exists (jwt_authenticator.cpp:220-318); no refresh endpoint (24h fixed expiry, re-login only).

The goal is: adding an entity's HTTP API = a codegen run, touching no shared file — mirroring SQL/C++/Qt.

• Per-entity generated unit <entity>_routes: thin class, parse → in-process <entity>_service call → rfl::json serialise, declarative .auth_required()=/.roles()=. Exactly the risk_routes shape, so directly templatable.
• Generated aggregator = the delegation (the registrar idea, done right — see generate messaging registrars via codegen): a generated register_refdata_routes(router, registry, ctx, sessions) that instantiates+registers each entity's routes; application.cpp calls the one aggregator. Adding an entity regenerates the aggregator — no hand-edit, and it is not a single growing function (it iterates the entity model list).
• Shared, modernized auth in the session/authenticator + login; generated routes only declare auth_required so the fix lands once and all inherit.
• OpenAPI generated per entity (the registry->register_route calls), so the spec stays in sync.

1. Modernize HTTP auth: implement RS256-from-file to align with the fleet (or consciously decide HS256 + propagate), set tenant_id (and party) in login claims, fail closed when unconfigured, drop the 100-year leeway, add a refresh endpoint. Foundation for everything below.
2. Unpick country into a per-entity country_routes unit + a delegation aggregator wired into application.cpp (hand-written, modelled on =risk_routes=/currency, structured to be codegen-ready). Reference impl.
3. Templatize into a codegen HTTP facet (generate <entity>_routes + the aggregator + OpenAPI); regenerate country and prove zero-diff against the hand-written unit.
4. Per-component/per-entity rollout tasks: generate HTTP for each commissioned entity (country, currency, party_status, party_type, …). One task per component keeps it reviewable.