fix(rest): put each registrar's docblock back on its own method; declare Clause-② yes (narrowing)

The user-work registrar had been inserted between the security-explain
registrar's docblock and its body, so each method carried the other's
docblock. It now sits after registerSecurityExplainEndpoints, and the diff
against main is a pure addition.

The changeset declares Clause-②: yes (narrowing): the published
FieldErrorCode enum gains a member, which widens the public face.

Claude-Session: https://claude.ai/code/session_01Utp6CZavYYLh5k5r6jhgCF
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

.changeset/30205-banned-user-work-handover.md

@@ -8,7 +8,7 @@
 
 feat(objectql,rest)!: a new assignment to a banned user is refused, and a banned user's records can be counted and handed over in bulk (#30205)
 
-Clause-②: no (narrowing) — a non-system create or update that sets a user field (the owner field, a `user` field, or a `lookup` to `sys_user`) to a user whose ban is in force is refused `400 VALIDATION_FAILED` with the field code `reference_user_banned`, a write that answered `201` / `200` before. A value the row already stores is not judged, so a record that already holds the banned user stays editable. The two new routes and SDK methods are additions.
+Clause-②: yes (narrowing) — the published `FieldErrorCode` enum gains the member `reference_user_banned`. A non-system create or update that sets a user field (the owner field, a `user` field, or a `lookup` to `sys_user`) to a user whose ban is in force is refused `400 VALIDATION_FAILED` with that field code, a write that answered `201` / `200` before. A value the row already stores is not judged, so a record that already holds the banned user stays editable. The two new routes and SDK methods are additions.
 Metadata-protocol: none
 Skills-docs: no move in `skills/**`, which teaches no user-assignment verdict; `content/docs/permissions/administrator-guide.mdx` gains "Handing over a banned user's work" and its offboarding quick path points at it.
 

packages/rest/src/rest-server.ts

@@ -6181,19 +6181,20 @@ export class RestServer {
      * business) and returns 501 when no security service exposing `explain`
      * is mounted (a deployment without `@objectstack/plugin-security`).
      */
-    private registerUserWorkEndpoints(basePath: string): void {
-        // [#30205] The body lives in `user-work-routes.ts`. This literal hands it
-        // every member it reads (see `UserWorkRouteHost`); the engine provider
-        // FIELD goes as a getter, read when a handler reads it.
-        const readObjectQLProvider = () => this.objectQLProvider;
-        const host: UserWorkRouteHost = {
+    private registerSecurityExplainEndpoints(basePath: string): void {
+        // [#23050 slice 6] The body moved to `security-routes.ts`. This literal
+        // hands it every member it reads — the list IS its dependency on this
+        // class (see `SecurityExplainRouteHost`, and that module's header for why
+        // `securityServiceProvider` is a getter).
+        const readSecurityServiceProvider = () => this.securityServiceProvider;
+        const host: SecurityExplainRouteHost = {
             routeManager: this.routeManager,
-            get objectQLProvider() { return readObjectQLProvider(); },
+            get securityServiceProvider() { return readSecurityServiceProvider(); },
             resolveRequestEnvironmentId: (...a) => this.resolveRequestEnvironmentId(...a),
             resolveExecCtx: (...a) => this.resolveExecCtx(...a),
             enforceAuth: (...a) => this.enforceAuth(...a),
         };
-        registerUserWorkEndpoints.call(host, basePath);
+        registerSecurityExplainEndpoints.call(host, basePath);
     }
 
     /**
@@ -6210,20 +6211,19 @@ export class RestServer {
      * Neither touches the ban. `@objectstack/core`'s `user-assigned-work.ts`
      * holds the rules.
      */
-    private registerSecurityExplainEndpoints(basePath: string): void {
-        // [#23050 slice 6] The body moved to `security-routes.ts`. This literal
-        // hands it every member it reads — the list IS its dependency on this
-        // class (see `SecurityExplainRouteHost`, and that module's header for why
-        // `securityServiceProvider` is a getter).
-        const readSecurityServiceProvider = () => this.securityServiceProvider;
-        const host: SecurityExplainRouteHost = {
+    private registerUserWorkEndpoints(basePath: string): void {
+        // [#30205] The body lives in `user-work-routes.ts`. This literal hands it
+        // every member it reads (see `UserWorkRouteHost`); the engine provider
+        // FIELD goes as a getter, read when a handler reads it.
+        const readObjectQLProvider = () => this.objectQLProvider;
+        const host: UserWorkRouteHost = {
             routeManager: this.routeManager,
-            get securityServiceProvider() { return readSecurityServiceProvider(); },
+            get objectQLProvider() { return readObjectQLProvider(); },
             resolveRequestEnvironmentId: (...a) => this.resolveRequestEnvironmentId(...a),
             resolveExecCtx: (...a) => this.resolveExecCtx(...a),
             enforceAuth: (...a) => this.enforceAuth(...a),
         };
-        registerSecurityExplainEndpoints.call(host, basePath);
+        registerUserWorkEndpoints.call(host, basePath);
     }
 
     /**