feat: ordered arrays for step fields, actions, and gates

Implements ADR 021: `fields`, `actions`, `gates` on the runtime step and
the definition step are ordered `[]{name, ...}` arrays on the wire instead
of name-keyed dicts, preserving authorial display order through every
layer (OpenAPI, ogen types, Go domain, validator, mappers, embed loader,
JSONB storage). `transitions` stays a dict.

The default Liquid template will iterate the arrays and build a
name-indexed map locally for keyed lookups; that template change rides
with the frontend PR.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: vitorbari

api/generated/oas_json_gen.go

@@ -1,9 +1,15 @@
 type: object
-required: [type, text_key]
+required: [name, type, text_key]
 description: |
   A data input capability. Describes what the user must provide.
   Does not contain display text — only a `text_key` resolved client-side.
 properties:
+  name:
+    type: string
+    description: |
+      Field name, matching a property in the flow's user schema. Carries
+      the submitted value back to the engine.
+    example: email
   type:
     type: string
     enum: [text, email, password, tel, number, url, date, hidden]

api/generated/oas_schemas_gen.go

@@ -32,31 +32,31 @@ properties:
     example: [email, password]
 
   actions:
-    type: object
+    type: array
     description: |
-      Actions the user can take. Keyed by action name.
-      The action name is what the frontend sends back in the submit request.
-      If omitted, the engine provides a default `submit` action.
-    additionalProperties:
+      Ordered list of actions the user can take. The action name is what the
+      frontend sends back in the submit request. If omitted, the engine
+      provides a default `submit` action.
+    items:
       $ref: step-action.yaml
-    default: {}
+    default: []
     example:
-      submit:
+      - name: submit
         primary: true
-      forgot_password: {}
+      - name: forgot_password
 
   gates:
-    type: object
+    type: array
     description: |
-      Security gates that must be satisfied before submission. Keyed by gate
-      name. Each gate selects a kind (e.g. "captcha") and provider-specific
+      Ordered list of security gates that must be satisfied before submission.
+      Each gate selects a kind (e.g. "captcha") and provider-specific
       configuration. The engine may also inject gates dynamically based on
       policy.
-    additionalProperties:
+    items:
       $ref: gate.yaml
-    default: {}
+    default: []
     example:
-      bot_check:
+      - name: bot_check
         kind: captcha
         provider: altcha
 
@@ -95,7 +95,7 @@ properties:
     description: |
       Maps action/outcome names to their transition descriptor.
 
-      Keys match action names from the `actions` dict. Additional keys
+      Keys match action names from the `actions` array. Additional keys
       come from implicit outcomes based on schema annotations
       (e.g. `user_not_found` from `x-unique` fields) and engine
       events (e.g. `sso`, `callback`).

api/generated/oas_validators_gen.go

@@ -1,33 +1,34 @@
 type: object
 required: [name, fields, actions, gates]
 description: |
-  A step contains unordered capability dictionaries: what to collect (fields),
+  A step contains ordered capability arrays: what to collect (fields),
   what the user can do (actions), and what security gates must be satisfied (gates).
-  Layout and element ordering are controlled by the LiquidJS template in `branding.liquid_template`.
+  The LiquidJS template in `branding.liquid_template` iterates these arrays in order
+  and builds name-keyed indexes locally for lookup.
 example:
   name: login
   texts:
     title_key: login.title
     description_key: login.description
   fields:
-    email:
+    - name: email
       type: email
       text_key: login.field.email
       required: true
-    password:
+    - name: password
       type: password
       text_key: login.field.password
       required: true
   actions:
-    submit:
+    - name: submit
       text_key: login.action.submit
       primary: true
-    register:
+    - name: register
       text_key: login.action.register
-    recover:
+    - name: recover
       text_key: login.action.recover
   gates:
-    captcha:
+    - name: captcha
       kind: captcha
       provider: altcha
       config:
@@ -65,32 +66,32 @@ properties:
     format: uri
     description: URL to navigate to (e.g., SSO provider redirect).
   fields:
-    type: object
+    type: array
     description: |
-      Unordered dictionary of input fields to collect. Keyed by field name.
-      The LiquidJS template controls which fields appear and in what order.
-      Field metadata (type, validation) is resolved by the engine from the
-      flow's user schema.
-    additionalProperties:
+      Ordered list of input fields to collect. Field metadata (type, validation)
+      is resolved by the engine from the flow's user schema. The LiquidJS
+      template iterates this array; for keyed lookup it builds a name-indexed
+      map locally.
+    items:
       $ref: field.yaml
-    default: {}
+    default: []
   actions:
-    type: object
+    type: array
     description: |
-      Unordered dictionary of available user actions. Keyed by action name.
-      The LiquidJS template controls positioning and presentation.
-    additionalProperties:
+      Ordered list of available user actions. The LiquidJS template iterates
+      this array and builds a name-indexed map locally for keyed lookup.
+    items:
       $ref: step-action.yaml
-    default: {}
+    default: []
   gates:
-    type: object
+    type: array
     description: |
       Security gates that must be satisfied before the step can be submitted.
       The engine injects gates dynamically based on policy, even if they
       are not declared in the flow definition.
-    additionalProperties:
+    items:
       $ref: gate.yaml
-    default: {}
+    default: []
   sso_providers:
     type: array
     description: Available SSO identity providers for this step.

api/openapi/components/flows/field.yaml

@@ -1,10 +1,14 @@
 type: object
-required: [kind, provider]
+required: [name, kind, provider]
 description: |
   A security challenge that must be satisfied before this step's submission
   is accepted. The engine may also inject gates at runtime based on policy
   or risk evaluation.
 properties:
+  name:
+    type: string
+    description: Gate identifier within the step.
+    example: bot_check
   kind:
     type: string
     enum: [captcha]

api/openapi/components/flows/flow-definition-step.yaml

@@ -1,9 +1,13 @@
 type: object
+required: [name]
 description: |
-  Configuration for a user-invokable action on a step. Keyed by action name
-  in the parent dictionary. The action name is sent back in the submit
-  request as `action`.
+  Configuration for a user-invokable action on a step. The `name` is sent
+  back in the submit request as `action`.
 properties:
+  name:
+    type: string
+    description: Action identifier. Sent back in the submit request as `action`.
+    example: submit
   primary:
     type: boolean
     default: false