Add backend API contract audit

docs/CODEX_EXECUTION_LOG.md

@@ -1,3 +1,38 @@
+## Sprint 48 Backend API contract audit (2026-06-17)
+
+Changed:
+- Added `scripts/audit_api_contracts.py` to import the FastAPI app, enumerate the implemented `GET`/`POST`/`PATCH`/`DELETE` route surface and compare it with active `### METHOD route` headings in `docs/API_CONTRACTS.md`.
+- Added the API contract audit to `scripts/run_readiness_check.sh`.
+- Corrected contract drift in `docs/API_CONTRACTS.md`:
+  - documented `GET/PATCH /api/v1/projects/{project_id}/areas/{area_id}`;
+  - corrected vector stats from `POST` to implemented `GET`;
+  - documented `GET /api/v1/projects/{project_id}/datasets/{dataset_id}/content`;
+  - changed non-implemented building-stats, legacy analysis object-detection/segmentation and YOLO export entries from active route headings to future-route notes.
+- Added `backend/tests/test_sprint48_api_contract_audit.py`.
+- Updated `scripts/README.md`, `docs/TODO.md` and `CHANGELOG.md`.
+
+Validation:
+- RED: `cd backend && python -m pytest tests/test_sprint48_api_contract_audit.py -q` failed before implementation because the audit script, readiness integration and route docs were missing.
+- RED: `python scripts/audit_api_contracts.py` reported missing docs for 4 implemented routes and 5 stale documented routes.
+- `python scripts/audit_api_contracts.py` passed: 76 implemented routes matched docs and 2 explicit non-envelope endpoints were tracked.
+- `cd backend && python -m pytest tests/test_sprint48_api_contract_audit.py tests/test_readiness_gate.py -q` passed: 12 tests.
+- `python -m py_compile scripts/audit_api_contracts.py` passed.
+- `python -m compileall backend/app` passed.
+- `cd backend && python -m pytest -W error::DeprecationWarning` passed: 201 tests.
+- `bash scripts/run_readiness_check.sh` passed and included `API contract audit OK`.
+- `cd frontend && npm run typecheck` passed.
+- `cd frontend && npm run build` passed.
+- `cd backend && python -m alembic heads` passed: `202606120900 (head)`.
+- `cd backend && python -m alembic upgrade head --sql` passed.
+- `bash -n scripts/live_migration_smoke.sh` passed.
+
+Limitations:
+- This pass audits route documentation presence, implemented/stale route drift and explicit non-envelope exceptions. It does not yet exercise every error path response body at runtime.
+- No API behavior, migrations, provider fetching, AI behavior or product capabilities changed.
+
+Next recommended pass:
+- Add an error-envelope runtime audit for representative invalid/missing-resource paths across projects, datasets, providers, detection, segmentation, QA and exports.
+
 ## Sprint 47 Workbench interaction smoke (2026-06-17)
 
 Changed: