[lnieuwenhuis]

Independent review + release for contracts scope only: API-02, API-03, OPS-04, OPS-05. API-01 separately owned (USER APPROVED 3.6.0, design-only, no code in this PR). Base: origin/staging 6a2146a (PR #175 build-staging). Head: fix/audit-contracts-staging (3 cherry-picks ONLY: c2413cef API-02, c61bcb3a API-03, 0394ad6a OPS-04/OPS-05, rebased clean, 8 files, +408/-64). Original worktree macro-tracker-audit-contracts untouched at 0394ad6a. No agents, no new production deps, no main/production. HOLD MERGE: API-02 GoalHitRate wording describes DATA-03 target (entry-presence denominator, incl. zero-calorie eaten days) while db.rs:5347 still filters calories_kcal>0. Wording becomes true only with DATA-03 persistence fix. Parent will resume to integrate prerequisite and finish CI/merge/Railway. Review: contract parity verified (16 uuid, 2+4 date formats, barcode plain, 404s, recipe status UTC default, leaderboard 7-field parity, actorUserId null, UTC no-inference); proxy 35s>30s, 504 timeout envelope exact, 502 otherwise, single forward/no retry, no signal-forward change; TLS/pool/engine matrix verified against config.rs/postgres-config.js/sqlx/Cargo/lock/jsdom/CI; E2E flag verified against validate_test_routes_mode/playwright/routes. No real defects requiring code change; no regressions added. Verification (release tree, disposable DB macro_tracker_contracts_review_test on 127.0.0.1:55462): pnpm install frozen PASS; typecheck PASS; lint PASS; openapi-parity 5 passed; proxy 6 passed; db pure 35 passed; Rust config 23 passed; Rust api 77 passed; Rust full 176 passed (TEST_DATABASE_URL disposable, 0 failed); web DB-free 62/374 passed; web api-v1 full 55 passed via single bounded backend start/readiness/tests/finally-stop exact PID (no servers left alive). Backend-dependent DB suites not counted as passing without DB. Gitleaks outgoing 3 commits: no leaks. Diff check clean. Identity: lnieuwenhuis. CI/merge/Railway: pending parent resume after DATA-03; DO NOT MERGE yet.