Lower the JWT-only ceiling to 598

Two JWT-only routes were removed with the dead /system endpoints.

backend/tests/JWT_ONLY_CEILING

@@ -1 +1 @@
-600
+598

docs/MIGRATION_INVENTORY.md

@@ -13,7 +13,7 @@ debt. Regenerate with `python scripts/generate-migration-inventory.py`.
 | Concern | Door | Remaining | Ceiling | Policy |
 |---|---|---:|---:|---|
 | Identity lookups outside rbac.get_current_user() | rbac.get_current_user() | 68 | 68 | JWT-only routes; the API-key-capable population is held at 0 by a companion assertion |
-| Routes on bare @jwt_required() | auth_required() / role decorators | 600 | 600 | REGISTERED EXCEPTION: JWT-only is the deliberate default; conversion grants API-key access and happens per route, on decision |
+| Routes on bare @jwt_required() | auth_required() / role decorators | 598 | 598 | REGISTERED EXCEPTION: JWT-only is the deliberate default; conversion grants API-key access and happens per route, on decision |
 | HTTP statuses chosen by sniffing error text | typed errors from app.exceptions | 0 | 0 | INVARIANT at 0 - migration completed 2026-08-19 |
 | API crashes swallowed without recording | app.error_reporting | 0 | 0 | INVARIANT at 0 |
 | Hand-shaped {'error': ...} bodies in app/api | typed errors + the global handler | 848 | 850 | migrate when touched; new endpoints raise |