follow-up(#816): /auto could not converge

[chronoai-shining]

Escalation for #816

/auto blocked issue #816 ("[Misc] Gate/scope user-directory enumeration on /users/search and /users/resolve") and is escalating to a human.

• Reason: hard-merge
• Original issue: [Misc] Gate/scope user-directory enumeration on /users/search and /users/resolve #816
• Runner: auto-runner-20260604T121112Z-15019-15019-21847
• PR (left for review): 845

This issue is human-gated (auto:hold + status:triage); /auto
will NOT pick it up automatically. A human should triage, then either remove
auto:hold and add auto:eligible to re-enter the queue, or close it.

[chronoai-shining]

Root cause (diagnosed by run 20260604T121112Z-15019): PR #845's 5 failing tests are all in the new ornn-api/src/domains/users/routes.test.ts. The test sets ORNN_USER_DIRECTORY_RATELIMIT_PER_MIN=5 before import("./routes"), but routes.ts reads env at module level. Locally (scoped bun test src/domains/users/) the import is fresh → cap=5 → green. In CI the whole suite runs in one process and bootstrap-based integration tests import routes.ts first → module cached with cap=30 → all 5 cap-dependent assertions fail (RateLimit-Limit expected "5", got "30").

Fix (smallest): move the env reads (MIN_Q, RL_WINDOW_MS, RL_MAX) + directoryRateLimit + searchQuerySchema construction from module top-level into the createUserRoutes() factory (env read at factory-call time, behavior-neutral for prod boot), so the test's env override is honored regardless of import order. Alternatively make the tests derive the cap from the first response's RateLimit-Limit header instead of asserting the literal.

PR #845 is otherwise fully green (lint, typecheck, build, docker-build, gitleaks, audit, python-sdk, changeset, base-guard) and passed /auto review consensus (requirements approve 3/3 criteria).