api-review(rum): add POST /rum/issue/export + fix stale orderby enum

[flashduty]

api-review daily run 2026-08-26 (audit-only path)

Generator pipeline unavailable again this round: the team knowledge pack still lacks runbooks/api-review-daily.md and runbooks/api-review-apply-patches.py (gap since 2026-08-24), so the deterministic audit-on-HEAD path was used (same as 08-24 → #305, 08-25 → #310).

Registry vs committed spec

• Public rows (auth="all", excluding /event/push/*): 338 (was 337)
• Committed spec paths across the 5 modules + consolidated: 337 → 338 after this PR
• Drift found: 1 new operation missing from the specs

Operation changes per module

Module	Added	Updated	Removed
rum	1	0	0
on-call / platform / monitors / safari	0	0	0

Added — POST /rum/issue/export → rum-issue-read-export ("Export issues as CSV" / "导出 Issue 列表"), tag RUM/Issues (zh: RUM/RUM 问题跟踪):

• Registry row rumIssue:read:export (fc-pgy e90419d8 + fde7843b); handler fc-rum/cmd/server/controller/issue/export.go; request filters reuse issueListInput (fc-rum/cmd/server/controller/issue/info.go).
• The response is a text/csv attachment, not the JSON envelope — modeled after the session-replay NDJSON precedent: 200 modeled as text/csv string schema plus X-Export-Total / X-Export-Truncated headers (both emitted by the handler).
• Rate limits from the registry row: 200 requests/day; 100 requests/minute; 10 requests/second per account; row is is_audit: true → standard audit bullet in Usage.
• New schema RumIssueExportRequest — filters identical to RumIssueListRequest; p/limit accepted but ignored (documented); export_fields enum = the 18 stable keys from fc-rum logic/issue/export.go (exportFields); time_zone is IANA, default Asia/Shanghai per types.DefaultTimeZone; console_origin builds the issue_url column.

Pre-existing drift fixed

• RumIssueListRequest.orderby enum + Usage bullets (en/zh, split + consolidated) now include severity — Go binding is oneof=created_at updated_at session_count error_count severity since fc-rum 67c6b92 (2026-08-05); the committed spec listed only 4 values.

docs.json / api-catalog reconciliation

• docs.json: +2 nav entries ("POST /rum/issue/export" under RUM → Issues / RUM 问题跟踪, en+zh)
• api-catalog.mdx (en+zh): +1 row each; RUM count 35 → 36; total 337 → 338

Examples

Constructed from request/response schemas + handler code — the dev API is not callable from this environment (no credentials). Request example reuses the issue/list example IDs (NHEacQHi2DhXqobr9qPQz9, H8kZSmxiE7EgdyD4fCyyNa); the CSV response example mirrors the 7 selected columns with timestamps rendered in Asia/Shanghai.

Unresolved

• None — handler located for the new registry row; no registry row without a handler.

Notes

• monit-webapi is not on GitHub (flashcatcloud/monit-webapi → 404); monitors module remains unchanged from HEAD, same as previous runs.
• Pre-existing, not touched this round: safari /safari/session/export 200 response has no example (streaming NDJSON) — flagged for a future pass.
• Sort-key deep comparison per output file: every diff line is attributable to the items above; no reordering.