Inconsistent 404 responses for endpoints hidden by `operator_features` restrictions

Nobody has claimed this yet.

There's a big section of code in `frontend.h:find_endpoint` to populate 404 reponses, also handling the case where we have a matching _path_ but not a matching _HTTP method_ (/verb), to respond to `OPTIONS` queries or fill a `Method not allowed` response.

But if we decide not to execute an endpoint because of a missing operator feature, we take a totally separate path later, returning a blank `404` with no body or further details.

This is an annoying inconsistency, but will be worse if we want to treat `operator_features` as properly _hiding_ endpoints. If distinguishing non-implemented from non-visible endpoints has any security value, this breaks it.

We should make these consistent, by pushing the `operator_features` check into `find_endpoint()`. This is non-trivial because of the `Method not allowed` handling. We probably need to change the interaction between the frontend and the endpoints, returning a set of endpoints that match the _path_ and then filtering by method (or feature) ourselves.

Start in frontend.h:find_endpoint and trace how endpoint lookup interacts with the later operator_features check, including path matches with unsupported HTTP methods and OPTIONS handling. Review the existing 404 and Method not allowed response paths first. Done means feature-hidden endpoints use the same response behavior as other endpoint lookup failures without exposing inconsistent details.

Written by the indexing model from the issue text.