The OpenAPI document describes signing up and signing in: users, sessions and the first admin #5037

Intent: an agent that makes its own account (and a forge's first admin) does it from the OpenAPI document. Never put a real secret or token in an example.

Done:

• [ ] src/contract/openapi.ts has a row for POST /api/v1/users, POST and DELETE /api/v1/sessions, and the /api/v1/first-admin and /api/v1/first-admin/recover routes, each with auth, the body and query fields its handler reads, its success status when not 200, and the refusals it answers by stable error code
• [ ] each summary says the answer's shape exactly as the handler answers it today
• [ ] test/openapi.test.ts still passes, and a new test asserts each new path and method is in the served document (GET /contract/openapi.json)

Files: src/contract/openapi.ts, one new test. Other issues add OpenAPI rows in parallel: add these as one block after the last ${REPO} row and before /mcp, and change no other row. Do not change any route.