An access proxy protects `/api/users` and one service endpoint still bypasses...

The user path exists, yet normalization and route order make the broader machine policy win on one URL form.