Close the HTTP contract loop

[heimanba]

Summary

• route files and skills through the shared Zod/OpenAPI seam, including multipart uploads
• enforce runtime-route coverage and committed OpenAPI snapshot freshness
• generate WebUI wire types from OpenAPI and keep domain-specific response mapping in explicit adapters
• fix the environment response-envelope mismatch and remove unsupported list query parameters

Root cause

HTTP routes could bypass createRoute + openapi, the committed snapshot had no freshness gate, and the WebUI maintained a separate handwritten wire contract. Those seams allowed runtime routes, documentation, validation, and client types to drift independently.

Impact

The runtime now exposes 32 documented operations across 25 paths. Files and skills retain their existing validation/error behavior, while WebUI requests are checked against generated method, path, query, body, and response types.

Validation

• bun run lint:changed
• bun run test:server — 50 passed
• bun run test:webui — 114 passed
• bun run typecheck:server
• bun run typecheck:webui
• bun run check:architecture
• bun run build:webui
• pre-push bun scripts/verify.ts push