HTTP surface of the ops plane: every read, plus the two account-lifecycle routes.

Every list endpoint here returns the same envelope, clamps its own paging, and rejects a sort field it does not recognise with 400 rather than ordering by something the caller did not ask for.

These routes are mounted behind asobi_ops_auth:verify/1, the operator capability check (ADR 0007) - never the player-scoped bearer check the rest of /api/v1 uses, which would let any authenticated player, guest included, enumerate the deployment. Every read projection here is still held to exactly what the equivalent public endpoint already exposes.

erase_player/1 and export_player/1 are the exceptions to that last sentence, deliberately: an operator answering a deletion or access request needs more than a player's own profile view. They are the only two routes on this plane that are not reads, they carry their own capability classes (erasure and player_data), and the erasure is audited inside its own transaction. See asobi_player_erase.