The OpenAPI document describes secrets, tokens, sessions and telemetry, and says which of them a token can never call #4868

Intent: a harness knows from the description alone which credential routes it may call. Tokens and sessions are managed only from a browser session or with a password (requireAccount in src/http/respond.ts).

Done:

• [ ] rows in src/contract/openapi.ts for GET /api/v1/secrets/{scope}, DELETE /api/v1/secrets/{scope}/{name}, GET/POST /api/v1/tokens, DELETE /api/v1/tokens/{id}, POST/DELETE /api/v1/sessions and GET /api/v1/telemetry/ system, flow, sources and history, placed right after the existing PATCH {REPO}/issues/{number} row
• [ ] the token and session rows say plainly that a bearer token is refused, and the secrets rows that a value is never read back

Each row says what the route answers (the shape in its summary, exactly as the handler answers today), whether it needs a token (auth) and which scope, and its body fields, query and refusals, as the existing rows do. Use the methods src/http/api.ts registers. If a route needs "put" and #4844 has not yet added it to the Route method type, leave that route out and say so in the pull; do not add it here, because other issues would collide on that line. test/openapi.test.ts must still pass; add test/openapi-oa-sec.test.ts asserting each new path and method is in the served document. Other issues add rows in parallel, so put these exactly where named and nowhere else.