Add documentation clarifying deployment configuration and operational tradeoffs

Add documentation to `replit.md` to specify `artifact.toml` as the canonical deployment configuration and enhance comments in `routes/index.ts` to explain operational tradeoffs for stub mode.

Replit-Commit-Author: Agent
Replit-Commit-Session-Id: 90c7a60b-2c61-4699-b5c6-6a1ac7469a4d
Replit-Commit-Checkpoint-Type: full_checkpoint
Replit-Commit-Event-Id: f46cc2d3-95ce-4f2b-8ab1-d8cd41d10743
Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/9f85e954-647c-46a5-90a7-396e495a805a/90c7a60b-2c61-4699-b5c6-6a1ac7469a4d/G03TLre
Replit-Helium-Checkpoint-Created: true

artifacts/api-server/src/routes/index.ts

@@ -41,6 +41,11 @@ router.use(worldRouter);
 // confirmation, so we expose it whenever stub mode is active regardless of NODE_ENV.
 // In real production with a live LNbits backend, stubMode is false, so these
 // routes remain unexposed.
+//
+// OPERATIONAL TRADEOFF: Running the testkit against a live node with LNBITS_STUB=true
+// (e.g. for CI without a real Lightning backend) will expose dev routes in that
+// process. This is intentional — stub mode has no real funds, so the exposure
+// is harmless. Never set LNBITS_STUB=true on a node with a real LNbits backend.
 if (process.env.NODE_ENV !== "production" || lnbitsService.stubMode) {
   router.use(devRouter);
 }