[EPAC-2292]: Record project-level bill diff backend route verification

[riddim-developer-bot]

Summary

Project-level backend route verification for the bill diff endpoint
GET /api/v1/bills/{id}/diff (EPAC-2292).
This is a verification gate, not an implementation change: it proves the shipped
repo state and the staging runtime agree across all four sources of truth
(OpenAPI, deployment manifest, Lambda handler, live deployment) before
EPAC-2018 can close.

This PR records the evidence as docs/backend/epac-2292-backend-route-verification.md,
following the same convention as the earlier verification gates
(EPAC-2291 → docs/backend/epac-2291-backend-route-verification.md,
EPAC-2289,
EPAC-2293). No backend, app,
or contract code is changed.

Verdict: PASS

No gaps found; no follow-up implementation issues required.

Verification evidence (captured 2026-06-15)

Route reconstructed from four independent sources, none trusted alone:

Source	Result
backend/openapi/openapi.json (getBillVersionDiff, 200 → BillVersionDiff)	Declared
backend/manifest/deployment-services.json (bills, staging + production)	Declared
backend/bills/main.go (LoadBillVersionDiff usecase)	Serves route
Live staging runtime	Reachable, service-owned responses

Handler tests:

cd backend && go test ./bills/...
ok  epac/bills            4.479s
ok  epac/bills/internal/adapter/sqlite
ok  epac/bills/internal/usecase

TestHandleRequestGetsBillVersionDiff invokes the route with valid from/to
and asserts the body decodes to the documented BillVersionDiff schema.

Repo smoke check (scripts/ci/backend_staging_smoke.py --environment staging --mode full):

PASS bills:diff-route: HTTP 400
PASS bills:diff-unknown: HTTP 404
PASS bills:diff-full: HTTP 200
PASS bills:diff-one-version: HTTP 204

Live staging (https://staging-api.epac.riddimsoftware.com):

Case	Result
C-11 multi-version diff	200, clauses.length == 82
missing from/to	400 service-owned (not API Gateway Not Found)
C-10 one-version	204 empty
unknown bill	404 service-owned

Why a PR for a verification issue

The issue scopes out patching backend code; it does not produce app/service
changes. Per repo convention these gates land their evidence as a docs/backend/
record (see EPAC-2291 #819, EPAC-2293 #820). The pass/fail verdict and staging
evidence are also posted as the required Linear comment on EPAC-2292.

Testing

• go test ./bills/... — PASS
• backend_staging_smoke.py --environment staging --mode full — all PASS
• Direct curl against staging for all documented cases — PASS

Docs-only change; no Release-Note: (no user-visible behavior change).