The OpenAPI document describes the caller's origin apps (list, add, remove) in their own route file #5956

Replaces #5777. Both runs ended with their pull closed: src/contract/openapi.ts is one of the files the open pulls collide on (#5924). This waits for #5936, which splits that file into one file per route.

Done when:

• [ ] On main, src/contract/ has one file per route (from #5936). If not, decline at once without a pull.
• [ ] A new route file describes GET /api/v1/user/origin-apps, POST /api/v1/user/origin-apps and DELETE /api/v1/user/origin-apps/{id}, with bodies, answers and refusals as the routes give them. A client secret is described as written, never read back.
• [ ] Those three leave NOT_YET_DESCRIBED in test/openapi-coverage.test.ts, and test/openapi.test.ts and test/openapi-coverage.test.ts pass.
• [ ] The origins routes #5151 owns are not part of this.