Activate ORD discovery endpoints (both 404 on PROD + DEV)

[jung-thomas]

Problem

The Open Resource Discovery (ORD) endpoints are documented as live but return 404 everywhere — PROD and the DEV backend directly.

Probed 2026-09-14:

URL	PROD	DEV srv
/.well-known/open-resource-discovery	404	404
/ord/v1/documents/ord-document	404	404

(DEV srv = https://tutorial-system-dev-tutorials-srv.cfapps.eu10-005.hana.ondemand.com)

Context

• fix(ord): catalog MCP surfaces in ORD document (bump @cap-js/ord ^1.9.3) (#2249) #2255 bumped @cap-js/ord to ^1.9.3 so MCP surfaces get cataloged in the generated ORD document. That was verified only at build time (cds compile srv --to ord → 30 apiResources incl. 5 mcp) — not that the runtime endpoint serves.
• fix(ord): catalog MCP surfaces in ORD document (bump @cap-js/ord ^1.9.3) (#2249) #2255 explicitly leaves the two ORD smoke tests in test/smoke/public-endpoints.test.js as it.skip — "routes not active in production CSN" — i.e. this wiring gap is known and deferred.
• Approuter (approuter/xs-app.json) routes ^/ord/(.*)$ → /ord/$1, but there is no route for /.well-known/open-resource-discovery, so even if the CAP side served it, the discovery entry point is unreachable through the approuter.

Scope (tomorrow)

1. Get @cap-js/ord runtime routes active in the served (production) CSN so /ord/v1/documents/ord-document returns the ORD document (200 JSON) — investigate why the route isn't mounted at runtime despite build-time compile working.
2. Add an approuter route for /.well-known/open-resource-discovery (anonymous, → srv-api), placed ahead of the catch-all — mirrors the existing /.well-known/mcp.json handling.
3. Confirm no Akamai edge block on either path on PROD (same class as the recently-resolved .well-known/mcp.json block).
4. Un-skip the two ORD smoke tests in test/smoke/public-endpoints.test.js and assert 200 + valid JSON through the approuter.

Acceptance

• GET developers.sap.com/.well-known/open-resource-discovery → 200 JSON pointing at the document.
• GET developers.sap.com/ord/v1/documents/ord-document → 200 JSON, 30 apiResources incl. 5 mcp.
• Both verified live (probe, not code inspection), on PROD.
• ORD smoke tests un-skipped and green.

Blocks announcing the ORD catalog in the next What's New.