feat: implement the production HTTP API

PLANS.md

@@ -607,7 +607,7 @@ If all criteria pass, set this milestone to `DONE`, append its execution record,
 
 ## Milestone 011 — Implement the production HTTP API
 
-**Status:** `READY`
+**Status:** `DONE`
 **Depends on:** Milestone 010
 
 ### Objective
@@ -635,11 +635,22 @@ Expose the contracted session and game commands through bounded, authenticated H
 
 If all criteria pass, set this milestone to `DONE`, append its execution record, and change Milestone 012 from `BLOCKED` to `READY`.
 
+### Execution record
+
+- Date: 2026-08-28
+- Board model and revision: ESP32-C6FH4 QFN32, revision v0.2.
+- Toolchain and library versions: PlatformIO Core 6.1.19; `espressif32` 7.0.1; ESP-IDF 6.0.1; `esp_littlefs` 1.20.4.
+- Result: PASS.
+- Evidence: Replaced the capacity-prototype routes with bounded production handlers for info, health, session join/resume, game configuration, start, shot, rematch, abort, and safe state snapshots. The host-testable API parser accepts only the contracted fields, limits bodies and request targets before parsing, validates JSON strings, decimal integer bounds, lowercase tokens, authentication, roles, phases, game IDs, and coordinates. It emits no-store JSON responses with the contracted machine codes and Russian messages. Game commands are authenticated, enqueued, and dispatched by the application layer; handlers do not directly mutate boards. State responses use the Milestone 010 role-safe presenter.
+- Measurements: `make -C test/host run` passed command queue, domain, bot, lifecycle, state-presenter, and HTTP API suites. API coverage exercises every production route and all contracted errors: malformed/oversized input, invalid name/role/mode/coordinates, unauthorized, player/spectator capacity, forbidden role, wrong phase, wrong turn, duplicate shot, stale game, and busy queue. `pio run -e esp32-c6-devkitm-1` passed with 39,180 / 327,680 B RAM (12.0%) and 1,006,156 / 2,097,152 B flash (48.0%), within the Milestone 005 limits.
+- Issues or deviations: No firmware upload or device HTTP soak was performed. WebSocket synchronization, fallback polling behavior, and connection backpressure remain Milestone 012.
+- Next action: Milestone 012 is ready. Do not start it unless explicitly requested.
+
 ---
 
 ## Milestone 012 — Implement WebSocket synchronization and HTTP recovery
 
-**Status:** `BLOCKED`  
+**Status:** `READY`
 **Depends on:** Milestone 011
 
 ### Objective