Absorb external-links (doors) list surface; defer create/image/composite (BC3 #12375)

[jeremy]

Summary

BC3 #12375 documents the external-link (historically "door") resource — a dock tool pointing to an outside URL. spec/api-gaps/external-links-doors.md tracked it. A pre-implementation spike resolved the three blockers and scoped absorption to the cleanly-shippable surface.

Spike outcome

• List path collision → resolved by extension. ListRecordings already owns GET /projects/recordings.json with a type query and Recording.url. Door is reached by adding it to the RecordingType doc-enum + optional position/description/service (DoorService) on the shared Recording projection — no new operation, no path collision.
• 302/empty create transport → inconsistent across the six SDKs. Go/TS(fetch)/Kotlin(Ktor)/Swift(URLSession) follow the cross-origin redirect; Python (follow_redirects=False) and Ruby (Faraday) don't follow but face empty-body decode. "Model only the 302/empty response" needs a coordinated per-operation transport change across all six generated transports — out of scope for an additive absorption. Create deferred.
• image multipart → unmodeled residual gap (independently blocks a full flip).

Absorbed (this issue's PR — PR-4)

• Door RecordingType enum value + optional position/description/service (DoorService) on Recording.
• Go wrapper + runtime decode tests (full door shape decodes; non-door leaves door fields empty).
• Get/rename/trash reuse GetTool/UpdateTool/DeleteTool (no work).
• type=Door ListRecordings canary (validates statically; live dormant).

Deferred (residual gaps → entry is partial-coverage)

• CreateExternalLink (302 transport), image (multipart), the SPEC §18 create-and-discover composite. No JSON update path (PUT → 406) by contract.

Coordination record for the registry scheme; code ships in the linked PR.