GET /api/v1/flags answers every declared flag with why, default, owner issue and live value, as MCP `flags` does #8012

Intent: a harness that speaks OpenAPI reads the forge's flags without MCP; today only MCP flags (src/http/mcp/tools/flags.ts, through readFlags in src/actions/flags_view.ts) and Settings › Flags answer it.

Done looks like:

• [ ] A new src/http/api/flags.ts (in the shape of src/http/api/vision.ts) registers GET /api/v1/flags: it notes the session phase, calls readFlags(ctx.auth.user) and answers { flags } exactly as the MCP tool does; refused, it answers apiError("forbidden", 403, message) with readFlags's own message; with no session, 401 as the other admin reads do.
• [ ] src/http/api.ts: the import goes directly after the adminRoutes import and the call directly after adminRoutes(router); (another issue registers elsewhere).
• [ ] src/contract/openapi/routes/getApiV1Flags.ts describes it (auth true, the 403 refusal), exported from src/contract/openapi/routes/index.ts in its alphabetical place, so /api/v1/openapi.json lists it.
• [ ] A new test/api-flags.test.ts proves: an admin person gets 200 with the same rows MCP flags returns; an agent admin and a plain member get 403; no token gets 401; the route is in the OpenAPI document. It fails without the change.
• [ ] bun test test/api-flags.test.ts and the OpenAPI contract test pass.

Files: src/http/api/flags.ts, src/http/api.ts, src/contract/openapi/routes/getApiV1Flags.ts, src/contract/openapi/routes/index.ts, test/api-flags.test.ts Risks: read-only; setting a flag stays MCP flag_set and the page. Brief: a builder who knows the API.