docs(skill): full-route honesty — ~362 backend paths, core documented, rest via /docs-json

Audit vs live swagger: guide covers the CLI-mirrored operational core;
added verified aggregation/row-count + a full inventory section pointing
to the unauthenticated /docs-json spec for the ~35 uncovered groups
(auth/session, user, spaces, share, attachments, import/export, trash,
templates, org/oauth/admin/billing, official webhooks, plugin UI…).

skills/inkreach-teable/api-reference/rest-api.md

@@ -84,6 +84,8 @@ MUST be the `search[]` tuple form, plain `search=` is ignored), `skip` / `take`
 | Method & route | Purpose |
 |---|---|
 | `POST /api/base/{bid}/sql` | Read-only SQL (`{sql}`; JOIN/GROUP BY; no record ids) |
+| `GET /api/table/{tid}/aggregation/row-count` | Total row count (`{"rowCount":N}` — verified) |
+| `GET /api/table/{tid}/aggregation…` | Stats family (group-points, calendar-daily, search-count…) — see swagger for params |
 | `GET`/`POST` `/api/access-token`, `DELETE /api/access-token/{id}` | PAT management |
 | `POST /api/auth/signup` | Create account (open on this instance) |
 
@@ -151,3 +153,33 @@ const res = await fetch(triggerInput._apiBaseUrl + "/api/table/tblB/record", {
    `401` = bad/expired token, `403` = scope or base-role too low.
 6. To see the exact request the CLI sends for any operation, run it with
    `--debug` (prints method/url/body) — the fastest way to learn a route.
+
+## 5. Full Route Inventory (this guide ≠ the whole API)
+
+The backend exposes **~362 paths**; this guide documents the
+agent-operational core (what the CLI wraps). For everything else, the
+authoritative source is the live OpenAPI spec — **no auth needed**:
+
+```bash
+curl -s "$BASE/docs-json" | python3 -c "import json,sys; [print(m.upper(), p) for p,o in json.load(sys.stdin)['paths'].items() for m in o]"   # full list
+# browsable UI: $BASE/docs
+```
+
+Route groups NOT detailed in this guide (see docs-json for shapes):
+`/api/auth/*` (session signin/signout, password/email flows, oauth),
+`/api/user/*` (profile, lang, timezone, avatar), `/api/space/*` +
+`/api/base/{bid}/node/*` (spaces & folder tree), `/api/share/*` +
+`/api/base/{bid}/share` (public share views, 17 paths),
+`/api/attachments/*` (upload/signature/notify), `/api/comment/{tid}`,
+`/api/notifications/*`, `/api/mail-sender`, `/api/import/*` +
+`/api/export/*` + `/api/base/import*` (CSV/Excel/Airtable),
+`/api/table/{tid}/selection` (paste/copy ops), `/api/table/{tid}/undo-redo`,
+`/api/trash/*`, `/api/template/*`, `/api/pin/*`, `/api/organization/*`,
+`/api/oauth/*`, `/api/admin/*`, `/api/billing`, `/api/instance/usage`,
+`/api/webhook/{bid}` (official teable webhooks — distinct from the
+automation webhook route), plugin UI endpoints (`/api/plugin/*` panels,
+chart, proxy), `/api/v2/integrity`, `/api/v1/ai-proxy`.
+
+When you use one of these, verify the exact param shape from docs-json
+first — do not guess key names (the automation contract lesson applies
+instance-wide).