The OpenAPI document describes the caller's origins: list, add, connect by OAuth, sync, read repositories, remove #5151

Intent: an agent that brings a client's code over from GitHub or Forgejo can do it from the OpenAPI document alone.

Done:

• [ ] Rows for GET and POST /api/v1/user/origins, POST /api/v1/user/origins/oauth, GET /api/v1/user/origins/oauth/{id}, DELETE /api/v1/user/origins/{id}, POST /api/v1/user/origins/{id}/sync and GET /api/v1/user/origins/{id}/repos. Each has auth, its body and query fields as its handler reads them, its success status when not 200, and its refusals by stable error code. No row's example carries a real token
• [ ] Placed as one block directly after the GET /api/v1/migrate/{job} row, changing no other row
• [ ] test/openapi.test.ts still passes, and a new test asserts each new path and method is in the served document