docs(api): OpenAPI 3.1 контракт API v1 как source of truth (Refs #19)

- docs/openapi.yaml: все эндпоинты ТЗ, единый формат ошибок {code,message,details},
  writeOnly для private_key/preshared_key/password, WS-кадры metrics/stream.
- requirements-contract.txt: зависимости контрактных тестов (jsonschema,
  openapi-spec-validator, PyYAML) до мержа каркаса PR #47.
- .gitea/workflows/contract-openapi.yml: lint + контрактный тест + проверка
  актуальности сгенерированного TS-клиента.

.gitea/workflows/contract-openapi.yml

@@ -0,0 +1,55 @@
+name: contract-openapi
+# Контракт OpenAPI 3.1 (issue #19): линтеры, контрактный тест «схема ↔ реализация»
+# и проверка, что сгенерированный TS-клиент актуален относительно docs/openapi.yaml.
+on:
+  push:
+    branches:
+      - "**"
+  pull_request:
+    branches:
+      - main
+  workflow_dispatch:
+
+jobs:
+  contract:
+    name: openapi-contract
+    runs-on: ubuntu-latest
+    steps:
+      - name: checkout
+        uses: actions/checkout@v4
+
+      - name: python 3.12
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r requirements-dev.txt -r requirements-contract.txt
+
+      - name: lint (ruff + mypy)
+        run: |
+          ruff check backend
+          ruff format --check backend
+          mypy backend
+
+      - name: contract and unit tests (coverage >= 70%)
+        run: pytest
+
+  ts-client:
+    name: ts-client-is-current
+    runs-on: ubuntu-latest
+    steps:
+      - name: checkout
+        uses: actions/checkout@v4
+
+      - name: node 20
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+
+      - name: regenerate client and compare
+        run: |
+          bash ui/scripts/generate-api.sh
+          git diff --exit-code -- ui/src/api/generated/schema.d.ts