Add onboarding doc-test harness

Disposable rig that runs the global onboarding-tester agent against the
developer SDK-integration journey: boots a fresh keysat fixture, mints a
merchant-onboard scoped key, serves keysat-docs as the published corpus,
scaffolds a pristine Next.js/TS proof-of-work, and has the agent gate it
docs-only. Stage 1 (no payments) reached completed-clean over three runs;
see onboarding-harness/STAGE1-RESULT.md. Stage 2 (regtest buyer-pays) is
gated on the agent-payment-connect scope work.

onboarding-harness/sandbox-template/app/api/export/route.ts

@@ -0,0 +1,20 @@
+import { ROWS, toCsv } from "@/lib/reports";
+
+// The "Pro export" endpoint.
+//
+// PRISTINE STATE: this feature is currently FREE — anyone who hits it gets the
+// CSV. The goal of this proof-of-work is to gate it behind a valid Keysat
+// license so that only paying customers can export.
+//
+// (How you wire that in is up to the integrator following the Keysat docs.)
+
+export async function GET() {
+  const csv = toCsv(ROWS);
+  return new Response(csv, {
+    status: 200,
+    headers: {
+      "Content-Type": "text/csv",
+      "Content-Disposition": 'attachment; filename="acme-report.csv"',
+    },
+  });
+}