[#1150] Enforce OpenAPI runtime contract tests

[Jagadeeshftw]

Summary

• add CI contract validation for OpenAPI 3.1 structure, references, paths, parameters, request schemas, and response declarations
• run the validator from prebuild so contract drift blocks production builds
• add runtime regression coverage for auth wallet/refresh requests, billing request documentation, webhook URL security, proxy-style success/error envelopes, and the canonical response envelope
• retain deterministic tests that do not require a database, wallet, upstream service, or DNS success

Acceptance criteria

• Required auth fields and enum/security constraints are exercised at runtime.
• Success and error envelope shapes are parsed and asserted.
• OpenAPI references and document structure are checked in CI.
• Contract validation is part of the build lifecycle.

Verification

• npx jest --runInBand --forceExit tests/contract/openapi-runtime.test.ts — 26 tests passed
• npm run validate:openapi — contract structure valid (32 paths, 42 operations)
• npm run prebuild — passed; reports existing compatibility warnings for legacy operations that predate operation IDs/schema declarations
• npx prettier --check ... — passed

Repository-wide lint/typecheck still report pre-existing baseline issues in src/routes/refresh-token.test.ts:445, src/routes/quotas.ratelimit.test.ts:305, and src/routes/rate-limit.ts:17; those files are not modified here.

Closes #1150