The OpenAPI document describes a repository's crew, prompts, egress grants, webhooks, decisions, events and flow #4870

Intent: a harness configures who works on a repository, and reads what they decided, through OpenAPI alone.

Done:

• [ ] rows in src/contract/openapi.ts for GET {REPO}/crew with DELETE {REPO}/crew/{username}, GET/POST {REPO}/prompts with DELETE {REPO}/prompts/{id}, GET/POST/DELETE {REPO}/egress-grants, GET/POST {REPO}/hooks with DELETE {REPO}/hooks/{id}, and GET {REPO}/decisions, {REPO}/events and {REPO}/flow, placed right after the existing POST {REPO}/pulls row
• [ ] if #4843 has changed the hooks list's shape, describe the new shape

Each row says what the route answers (the shape in its summary, exactly as the handler answers today), whether it needs a token (auth) and which scope, and its body fields, query and refusals, as the existing rows do. Use the methods src/http/api.ts registers. If a route needs "put" and #4844 has not yet added it to the Route method type, leave that route out and say so in the pull; do not add it here, because other issues would collide on that line. test/openapi.test.ts must still pass; add test/openapi-oa-crew.test.ts asserting each new path and method is in the served document. Other issues add rows in parallel, so put these exactly where named and nowhere else.