Migrate to FastAPI 0.137 (lazy router inclusion) — scope decision, target 3.4.0

## Summary FastAPI [0.137.0](https://fastapi.tiangolo.com/release-notes/#01370-2026-06-14) reworked the router layer into **lazy router inclusion**: `include_router()` no longer leaves a flat list of materialized `APIRoute`s in `router.routes` — included routers can appear as `_IncludedRouter` wrappers, and a router's dependencies are now **frozen into each route at include time**. We currently cap `fastapi<0.137.0` (#68562). #68826 lifts the cap (cadwyn 7.1.0 now requires `fastapi>=0.137.1`) and fixes the execution-API part — but the bump is really a **broader migration that touches security-relevant route introspection**, so we want the FastAPI / token-scope / security owners to confirm the direction before we commit. Related: #68826 (WIP), #68562 (the cap), #68578 (added the cap). ## Why this makes our code better — 0.137 *enables* the cleaner pattern Today the execution API injects the OTel trace-context dependency by mutating `route.dependencies` on a shared, module-global router *after* assembly (`_inject_trace_context_dep`) — with an idempotent **strip-and-re-add**, because that global router is processed more than once per process (`cached_app` + `InProcessExecutionAPI`) and we have to de-dupe our own prior injection. 0.137's lazy inclusion **breaks that today** — but that's the point: the strip-and-re-add only ever existed to work around the old *mutable-shared-router* model. 0.137 freezing a router's dependencies into each route **at include time** is exactly the contract we want: it lets us declare the trace-context dependency **once, at build time**, in a fresh router per app, and it stays put. No shared mutable dependencies after routes are built, no post-hoc patching, **no strip-and-re-add**, and the test fixture that snapshot/restored the mutated global disappears. The migration *removes* a workaround rather than adding one. ## The hard part — token scope & security boundaries Several **security guards introspect `router.routes` expecting flat `APIRou…