GET /openapi.json describes every public /api/v1 route, and a test fails when a route has no entry #11256

This pull adds one test and nothing else. GET /openapi.json already described every public /api/v1 route, so most of the issue was already done.

What exists. /openapi.json redirects (308) to /contract/openapi.json. That is an OpenAPI 3.1 document with path, method, summary, parameters, the bearer scheme and an x-role on every operation. It is cached with an ETag as public, max-age=300. docs/MCP.md already names the URL. test/openapi-coverage.test.ts already fails when a registered route has no row.

What changed. The new test in test/openapi-coverage.test.ts walks the routes registered in src/http and fails on any whose OpenAPI summary is empty or under 10 characters. That covers the box "fails on a route missing a summary", and it reads the registered routes instead of the hand-kept ROUTES list, as juniper asked.

What I chose not to do

• Build from the router's table. The document is still built from the hand-kept row files under src/contract/openapi/routes/, with the coverage test tying them to the router. Building it from the router's own table is a larger change and should be its own issue and pull. That box stays open.
• Hide admin routes from other readers. I tried this earlier, and juniper's review said to remove it, so it is gone. The routes already check the caller's role. If it is wanted, it needs its own decision.

Checks. bun x tsc --noEmit and bun scripts/gate.ts showed no errors. test/openapi-coverage.test.ts passes (4 tests). I did not run the rest of the suite; the forge's check does.

Try it. curl -sL $ORIGIN/openapi.json returns the document. bun test test/openapi-coverage.test.ts runs the test.

The branch is behind main. My local rebase was never pushed, because I can't force-push. The pull's diff is just the one test file.

Closes #11230

This pull adds one test and nothing else. GET /openapi.json already described every public /api/v1 route, so most of the issue was already done.

What exists. /openapi.json redirects (308) to /contract/openapi.json. That is an OpenAPI 3.1 document with path, method, summary, parameters, the bearer scheme and an x-role on every operation. It is cached with an ETag as public, max-age=300. docs/MCP.md already names the URL. test/openapi-coverage.test.ts already fails when a registered route has no row.

What changed. The new test in test/openapi-coverage.test.ts walks the routes registered in src/http and fails on any whose OpenAPI summary is empty or under 10 characters. That covers the box "fails on a route missing a summary", and it reads the registered routes instead of the hand-kept ROUTES list, as juniper asked.

What I chose not to do

• Build from the router's table. The document is still built from the hand-kept row files under src/contract/openapi/routes/, with the coverage test tying them to the router. Building it from the router's own table is a larger change and should be its own issue and pull. That box stays open.
• Hide admin routes from other readers. I tried this earlier, and juniper's review said to remove it, so it is gone. The routes already check the caller's role. If it is wanted, it needs its own decision.

Checks. bun x tsc --noEmit and bun scripts/gate.ts showed no errors. test/openapi-coverage.test.ts passes (4 tests). I did not run the rest of the suite; the forge's check does.

Try it. curl -sL $ORIGIN/openapi.json returns the document. bun test test/openapi-coverage.test.ts runs the test.

The branch is behind main. My local rebase was never pushed, because I can't force-push. The pull's diff is just the one test file.

Left #11230 open: 1 unticked item remain (built from the router's own route table, not a hand-kept copy, so a new route appears by itself).