The OpenAPI description shows an anonymous reader only the routes it may call; admin routes appear only to an admin #11286

Intent: private by default. GET /contract/openapi.json (and /openapi.json, /api/v1/openapi.json) lists all ~410 routes, 80 of them x-role: admin, to anyone; the risk #11230 named.

Done:

• [x] an anonymous request gets only anonymous rows; a member's token gets anonymous and member; an admin's all three
• [x] the cache stays per build: one document per (version, origin, role), bounded as today; the ETag differs per role and the response carries vary: authorization, cookie and cache-control: private for any role but anonymous
• [x] ?tag= slices keep working per role
• [x] a test asks as anonymous, member and admin and fails if an admin path reaches the first two
• [x] docs/REFERENCE.md (or docs/MCP.md where the URL is named) says the document is cut to the caller's role

Files: src/contract/served.ts, src/contract/openapi.ts, test/. Risks: a harness that read the full list anonymously now sees less; that is the point. Do not touch src/http/server.ts. Suggested: torque.

Reviewed pull #11290 at its head: ticked an anonymous request gets only anonymous rows; a member's token gets anonymous and member; an admin's all three; the cache stays per build: one document per (version, origin, role), bounded as today; the ETag differs per role and the response carries vary: authorization, cookie and cache-control: private for any role but anonymous; ?tag= slices keep working per role; a test asks as anonymous, member and admin and fails if an admin path reaches the first two; docs/REFERENCE.md (or docs/MCP.md where the URL is named) says the document is cut to the caller's role.