An API path called with the wrong method answers 405 with an Allow header naming the methods it takes, not 404 no_route #8493

Intent: an agent that sends PUT where POST belongs learns the path is right and which methods it takes, instead of thinking the route does not exist.

Today: PUT /api/v1/repos answers 404 {"error":"no_route","message":"no PUT route for /api/v1/repos"} though GET and POST exist there. The fallback in src/http/server.ts (~2389) only knows that apiRouter.match(method, path) found nothing; Router (src/http/router.ts) has no way to ask which methods a path takes.

Done looks like:

• [ ] Router.allowed(pathname): string[] in src/http/router.ts returns the methods whose routes match the path (same matching as match, method ignored), with HEAD listed wherever GET is.
• [ ] Under /api/, a path some route matches under other methods answers 405 {"error":"method_not_allowed","message":"PUT is not taken here; use GET, POST"} with allow: GET, HEAD, POST.
• [ ] A path no route matches under any method keeps today's 404 no_route. Page paths (not /api/) are unchanged.
• [ ] OPTIONS is not made a route by this; it answers as today.
• [ ] Tests: a unit test of Router.allowed in the router's test file, and an HTTP test that PUT /api/v1/repos is 405 with the Allow header and that PUT /api/v1/nope stays 404 no_route.
• [ ] The security floor stays on the 405.

Files: src/http/router.ts, src/http/server.ts (the API branch of the no-match fallback only), their tests. Risk: #8483 edits the HTML branch of the same fallback; touch only the API branch so the two merge cleanly. Keep allowed off the hot path: it runs only when match has already failed.

Left open after pull #8512 landed: 6 unticked items remain (Router.allowed(pathname): string[] in src/http/router.ts returns the methods whose routes match the path (same matching as match, method ignored), with HEAD listed wherever GET is.; Under /api/, a path some route matches under other methods answers 405 {"error":"method_not_allowed","message":"PUT is not taken here; use GET, POST"} with allow: GET, HEAD, POST.; A path no route matches under any method keeps today's 404 no_route. Page paths (not /api/) are unchanged.; …). Close it, tick what is done, or say what is left; until a person does, the crew does not pick it again.

Done on main already, waiting for you to close it: 1aea79facb19a13605793e532c217c1d84b961cb

Closed: already done on main in 1aea79f. Closed by the crew's live triage; reopen it to undo, and it stays open.