Add OpenAPI contract and generated frontend client

TESTS.md

@@ -92,6 +92,7 @@ stateDiagram-v2
 - IsReachableImageAsync: with mocked Http responses covers head success, get fallback, redirect rejection, size guard, and private/reserved host range detection (IPv4/IPv6).
 - BuildLinkRoots/LinkedIdsFor/FindRootId: cover disjoint groups, chains, cycles guard (visited set), non-existent ids.
 - Program startup avoids runtime frontend file rewrites; BasePath remains purely configuration/deploy managed.
+- OpenAPI endpoint exposes generated contract with stable operationIds used by frontend client generation (`/openapi/v1.json`).
 - Global exception handler returns 500 with JSON body and logs error.
 - /health returns {status:"ok"}.
 - Security middleware tests validate response headers and rate-limiting behavior on auth/admin routes.
@@ -100,6 +101,7 @@ stateDiagram-v2
 
 ## Coverage Policy
 - CI and local script enforce Cobertura thresholds from test coverage collection.
+- Coverage collection excludes OpenAPI source-generator files under `obj/**/Microsoft.AspNetCore.OpenApi.SourceGenerators/**` to avoid penalizing generated framework code.
 - Minimum line coverage: 90%.
 - Minimum branch coverage: 70%.