API.md ships in the image; GET /api/docs/approved serves it behind api:docs

Moved to app/API.md so the build context carries it. The console renders
it at /leaders/api. tests/smoke_admin.py 162 -> 164.

app/admin_api.py

@@ -45,7 +45,7 @@ import os
 import re
 
 from fastapi import APIRouter, Body, Header, HTTPException, Query, Request
-from fastapi.responses import HTMLResponse
+from fastapi.responses import HTMLResponse, PlainTextResponse
 
 import auth
 import calendar_write
@@ -511,6 +511,20 @@ def whoami(request: Request, x_admin_token: str = Header(None)):
 _CAP_RE = re.compile(r"""_(?:auth|people_actor)\([^)]*?["']([a-z_]+:[a-z_]+)["']""")
 
 
+@docs_router.get("/docs/approved", response_class=PlainTextResponse)
+def api_docs_approved(request: Request):
+    """API.md: the approved reference, generated from this registry plus a
+    full HTTP drive of every route (tests/http_drive.py). Markdown; the
+    console renders it at /leaders/api. Same gate as /api/docs."""
+    _auth(request, None, "api:docs")
+    import pathlib
+    p = pathlib.Path(__file__).with_name("API.md")
+    if not p.exists():
+        raise HTTPException(404, "API.md is not in this build")
+    return p.read_text()
+
+
+
 def route_capability(endpoint):
     try:
         src = inspect.getsource(endpoint)