bulk-data rosbags: the descriptor size counts bytes the download does not serve, and the README documents removed snapshot routes

[bburda]

Summary

Three mismatches around rosbag snapshots over the REST API.

1. The descriptor size is the bag directory, the download is the storage file alone. GET /api/v1/apps/load_process/bulk-data/rosbags reports "size": 35943 (32768 bytes of .db3 plus 3175 bytes of metadata.yaml). Downloading the same item answers Content-Length: 32768. The nested environment_data.snapshots[] entry on GET .../faults/{code} carries the same size_bytes: 35943. RosbagCapture::calculate_bag_size in the fault manager sums every file under the bag directory, BulkDataHandlers::download in the gateway serves the inner storage file resolved by resolve_rosbag_file_path. A client sizing a transfer from the descriptor is off by the metadata file.

2. Documented snapshot routes do not exist. src/ros2_medkit_gateway/README.md lists GET /api/v1/faults/{fault_code}/snapshots, .../snapshots/bag and GET /api/v1/components/{component_id}/faults/{fault_code}/snapshots with examples, and the quick start in docs/tutorials/snapshots.rst ends with curl .../api/v1/faults/MOTOR_OVERHEAT/snapshots. All answer 404. The same tutorial's "Migration from Legacy Endpoints" table already lists them as removed. Snapshots are served inside GET .../faults/{code} and the bag through .../bulk-data/rosbags/{id}.

3. Access-Control-Expose-Headers is documented without its condition. docs/api/rest.rst lists it among the download's response headers. It is sent only when cors.allowed_origins matches the request's Origin, and then it names six headers, not one.

Proposed solution

1. Report the bytes the route serves, so the descriptor size, the nested size_bytes and Content-Length agree.
2. Drop the removed routes from the gateway README and the tutorial quick start. The migration table stays.
3. Qualify the Access-Control-Expose-Headers line as CORS-only, or leave it to the OpenAPI document.

Additional context

ghcr.io/selfpatch/ros2_medkit-jazzy at f873448 (0.6.0) and a 0.7.0 build carrying #660, same result. ROS 2 Jazzy, Ubuntu 24.04, OPC UA plugin on an OpenPLC-style controller, snapshots.rosbag.format: sqlite3. Headers taken with curl -D -, directory size with du -sb in the container. The served file is a valid rosbag2 bag, ros2 bag info -s sqlite3 reads it standalone.

Already fixed in 0.7.0 and not part of this: Accept-Ranges on the download, the descriptor addressed by fault code, creation_date carrying the fault's timestamp. The missing x-medkit.source on a plugin freeze frame is #660.