Standardize TinyNode route contract across consumers (/app/* vs root)

During contract-seam scanning across CDH repos, I found a route-shape mismatch risk across TinyNode consumers:

- `deer` uses `/app/create`, `/app/query`, `/app/update`, `/app/overwrite`
- `TPEN-services` appears to use root routes `/create`, `/query`, `/update`, `/overwrite`, `/delete`

Recommended adjustment:
1. Document canonical TinyNode API surface and supported aliases.
2. Publish OpenAPI for TinyNode routes (including `/app/*` and root aliases if both are supported).
3. Add compatibility tests ensuring both consumer patterns continue to work, or explicitly deprecate one pattern with migration guidance.

Why this matters:
- Divergent route prefixes/method expectations increase break risk across consumers.

Filed by automation as requested; label: `copilot`.