Remove or guard /_test/* stub routes in production

The api-skeleton plan added three stub routes used only by integration tests:
- `POST /api/_test/validation-error` — throws `ApiValidationError` for testing the error mapper
- `POST /api/_test/internal-error` — throws a generic Error for testing 500 behavior
- `POST /api/_test/idempotency` — tests idempotency key replay

These have `{ schema: { hide: true } }` so they don't appear in the OpenAPI doc, but they're live in production. They should either be removed before cutover or guarded behind `NODE_ENV !== 'production'`.

Came out of api-skeleton (PR #17), Follow-up item.