feat(api): publish validated OpenAPI contract

apps/web/src/lib/openapi-serving.test.ts

@@ -0,0 +1,11 @@
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { expect, it } from "vitest";
+import { GET } from "../app/openapi.yaml/route";
+
+it("serves the canonical YAML bytes publicly, without rewriting or authentication", async () => {
+  const response = await GET();
+  expect(response.status).toBe(200);
+  expect(response.headers.get("content-type")).toBe("application/yaml; charset=utf-8");
+  expect(Buffer.from(await response.arrayBuffer())).toEqual(readFileSync(resolve(process.cwd(), "../../openapi.yaml")));
+});