test: add Prism-based OpenAPI mock verification (Closes #452)

[laurentketterle-hub]

Summary

Runs stoplight/prism as a mock server in CI and replays the recorded request corpus against it, per #452. This proves the OpenAPI spec is complete enough to power a consumer-facing mock server.

• .github/workflows/prism-mock.yml — starts Prism (stoplight/prism:5 mock) against openapi/openapi.yaml, waits for readiness, replays the corpus, and uploads a coverage report artifact. Fails CI if any recorded request cannot be resolved.
• scripts/prism_replay.py — stdlib-only replay tool: sends each recorded request to the mock server, detects Prism resolution failures (4xx/5xx + Stoplight error bodies), writes prism-coverage.json, and exits non-zero on any unresolved request.
• tests/pact/prism-replay-corpus.json — the recorded request corpus (extensible; currently covers /api/health, /api/v1/plans, /api/subscriptions, /api/subscriptions/{id}).

Notes

• Prism strict schema mode surfaces missing examples/responses; unresolved routes produce Stoplight error bodies which the replay tool flags.
• Corpus is additive — extend the JSON array to grow coverage.

Closes #452