Complete routes.rs's table, which the docs now point at

AGENTS.md and PLAN.md were both carrying their own copy of the HTTP
surface, and the previous commit replaced those with a pointer to this
module doc comment -- which turned out to be missing ten routes that
exist: the four `/setups/{id}/importable*`, `/sessions/{id}/permission-mode`
and all five under `/models`. Naming it the source of truth is only worth
doing if it is one.

The two "later phases add" lines at the foot are gone. Setups replaced
`/hosts` in August and `/models` is the block just added above them, so
both were promising work already done.

cargo test (127), clippy --all-targets and fmt clean.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

server/src/routes.rs

@@ -13,6 +13,10 @@
 //!                                      (409 when the file no longer matches ifSha256)
 //! POST   /setups/{id}/file             {path} create empty; refused if it exists
 //! POST   /setups/{id}/dir              {path} create; refused if it exists
+//! GET    /setups/{id}/importable       Claude Code sessions on it that could be continued
+//! POST   /setups/{id}/importable/import   {sessions} -> 202; runs on the server
+//! POST   /setups/{id}/importable/delete   {sessions} -> 202; removes the machine's transcripts
+//! GET    /setups/{id}/importable/events   SSE: what is in flight against them
 //! PUT    /setups/{id}                  rename {name?} and/or re-probe {rediscover?}
 //! DELETE /setups/{id}                  remove, refused while sessions use it
 //! GET    /sessions                     list (id, provider, title, model, status, last activity)
@@ -36,6 +40,7 @@
 //! POST   /sessions/{id}/cwd            {cwd} -- move it; stops the process,
 //!                                     which starts again in the new one
 //! POST   /sessions/{id}/model          {model}
+//! POST   /sessions/{id}/permission-mode  {permissionMode}
 //! POST   /sessions/{id}/command        {text}  -- /compact, /clear, /rename x, or the dialect's own
 //!                                     (starts the process first if it has exited)
 //! POST   /sessions/{id}/compact
@@ -47,9 +52,13 @@
 //! GET    /notifications                SSE: every session's attention-wanting
 //!                                      moments, live only (see `notifications`)
 //! GET    /usage                        cached usage windows per provider
+//! GET    /models                       downloaded GGUFs, and what is being fetched
+//! GET    /models/search?q=Q            HuggingFace repositories matching Q
+//! GET    /models/files?repo=R          the GGUFs in one repository
+//! POST   /models/download              {repo, file}; rejoins the run already going
+//! POST   /models/cancel                {key}; the partial stays, so starting again resumes
+//! POST   /models/delete                {key}
 //! ```
-//! Later phases add `GET|PUT /models` config editing from the phone.
-//! Later phases add: `GET|PUT /hosts` and `/models` -- see PLAN.md's table.
 //!
 //! Everything here works purely in the common event model; nothing may
 //! branch on the session kind (that's what drivers are for).