Backend API follow-ups: dead-weight endpoint, proxy caching, MCP URLs, error hygiene #9627

Backend findings from the 2026-07-08 audit, verified still-open at current file:line on 2026-07-09:

• Medium#2 — /libraries/{id}/images loads the entire ~13 MB code corpus of ALL libraries to serve one (api/routers/libraries.py:100 → get_all_with_code()), then filters in Python. No frontend consumer exists (nothing in app/src calls it; repositories.py:173's docstring even claims MCP-only usage). Either add a per-library undefer(code) query or delete the endpoint.
• Medium#3 — MCP tools emit broken website_url /python/{spec_id} instead of /{spec_id} at api/mcp/server.py:107,235,327 (routes parse it as specId='python'). The per-impl call sites (307, 407) are already correct.
• Medium#4 — /proxy/html refetches interactive plot HTML from GCS per iframe load: fresh httpx.AsyncClient per request (api/routers/proxy.py:174), no server-side cache, and /proxy/html missing from the cache-header whitelist in api/main.py.
• Low#5 — DatabaseQueryError bakes raw str(SQLAlchemyError) into the client-visible message (api/routers/plots.py → api/exceptions.py:94-99), contradicting the no-leak policy in the same file.
• Low#6 — Cloud SQL async fallback wraps a sync pg8000 engine in async_sessionmaker (core/database/connection.py:191-199) — would 500 on first query if ever configured; fail fast instead.
• Low#7 — leftover /hello/{name} demo endpoint; three conflicting version strings (health.py 0.2.0, main.py 1.0.0, pyproject 3.0.0) — delete the endpoint, source the version from one constant.
• Low#21 — search_by_tags matches via substring LIKE over stringified JSON (core/database/repositories.py:205-207) — cross-category false positives; use JSONB containment (@>) per category.
• Low#8 (rest) — core/config.py:92 still defaults to claude-sonnet-4-6; bump to claude-sonnet-5 after a side-by-side. (The dead highcharts pattern block was removed in fix: 15-library drift sweep — registry-derived names and copy #9624.)
• Low#20 — scripts/evaluate-plot.py: no prompt caching (image-first ordering defeats it), tight max_tokens, freeform JSON instead of structured output.

Audit: agentic/audits/2026-07-08-product-ux.md.