Routes implemented outside T3's typed EnvironmentHttpApi contract.

These cover guest shares, files, attachment capabilities, observability, device hub binary streams and browser upload/download. Authentication differs per route: guest shares require their share cookie and query, uploads use signed capability URLs, and media routes require scopes or a purpose-bound ticket. Pass cookies/proof/range headers explicitly. There is no cookie jar.

call/3 buffers bounded responses. stream/4 consumes with callback backpressure and finite byte/event/deadline limits. Device MJPEG/AVCC data is passed unchanged, without codec interpretation. This catalog reflects proxy routing; upstream device hubs can impose additional method/payload constraints. WebSocket upgrade endpoints belong to the WebSocket transport, not this module.