fix(review): harden the E2E-gap fixes after security/regression review

Addresses findings from an independent review of the gap-closing commits:

- R1 (regression): add #[serde(default)] to HttpDispatchPayload.method so
  async-HTTP outbox rows enqueued before the field existed still decode
  after upgrade instead of dead-lettering on "missing field `method`".
  Adds a regression test for the missing-key path.
- method case: uppercase ctx.request.method at the orchestrator boundary
  so it honors its documented "uppercased" contract for extension verbs.
  Route matching is already case-insensitive, so matching is unaffected.
- CLI hardening: percent-encode free-form path segments (app slug, topic
  name, ids, secret name) in the reqwest client so a value containing
  `/ ? #` can't break out of its URL segment. Adds a `seg()` helper +
  unit test and applies it uniformly across all path-interpolating
  methods (new and pre-existing).
- S1 (docs): correct the users::email_available enumeration framing — it
  adds no new vector vs. create's uniqueness error, but is cheaper and
  unthrottled; there is no built-in throttle/CAPTCHA primitive, so the
  honest mitigation is a kv-based counter. Updated SDK doc-comments,
  trait docs, and stdlib-reference.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

crates/orchestrator-core/src/api.rs

@@ -170,7 +170,12 @@ where
     E: ExecutorClient + 'static,
     R: ScriptResolver + 'static,
 {
-    let method = request.method().as_str().to_string();
+    // Uppercased so `ctx.request.method` honors its documented contract
+    // (extension methods arrive in their original case). Route matching is
+    // case-insensitive (see `routing::matcher::method_matches`), so this
+    // only normalizes the value surfaced to scripts / persisted in the
+    // async-dispatch payload.
+    let method = request.method().as_str().to_ascii_uppercase();
     let uri = request.uri().clone();
     let path = uri.path().to_string();
     let query_str = uri.query().unwrap_or("").to_string();