[P0][security] Object apiEnabled/apiMethods not enforced by REST

[os-zhuang]

Part of the metadata liveness audit umbrella #1878 (P0 security cluster).

Problem

Object apiEnabled / apiMethods are not enforced by the REST layer. An object cannot actually be hidden from the API via these flags, nor can its allowed HTTP methods be restricted — the REST handlers serve every registered object regardless of these declarations. Authors who set apiEnabled: false expecting an object to be API-invisible get the opposite.

Decision required (enforce or remove)

• Enforce: gate the REST routes on apiEnabled and validate the request method against apiMethods, returning 404/405 as appropriate.
• Remove: drop apiEnabled/apiMethods from ObjectSchema if API exposure will always be all-or-nothing.

Evidence

• docs/audits/2026-06-objectschema-property-liveness.md

[os-zhuang]

Enforced in #1899 (checkApiExposure in callData): apiEnabled:false → 404, non-whitelisted op → 405; system contexts bypass. Object can now be hidden/restricted via these flags.