Remove or guard /_test/* stub routes in production

[themightychris]

The api-skeleton plan added three stub routes used only by integration tests:

• POST /api/_test/validation-error — throws ApiValidationError for testing the error mapper
• POST /api/_test/internal-error — throws a generic Error for testing 500 behavior
• POST /api/_test/idempotency — tests idempotency key replay

These have { schema: { hide: true } } so they don't appear in the OpenAPI doc, but they're live in production. They should either be removed before cutover or guarded behind NODE_ENV !== 'production'.

Came out of api-skeleton (PR #17), Follow-up item.