[codex] ci: gate OpenAPI drift in CI

[shinzoxD]

Summary

• Add scripts/check-openapi-drift.mjs to compare mounted Express route operations with src/openapi.yaml.
• Add openapi:drift and validate:openapi scripts, then wire the combined validation into both CI workflows.
• Document the route-drift validation workflow in OPENAPI.md and CONTRIBUTING.md.
• Update src/openapi.yaml for existing mounted routes that were missing from the spec: credit draw, credit repay, and risk admin recalibration.

Closes #203

Validation

• Passed: npm ci
• Passed: npm run validate:openapi
• Failed, existing baseline: npm run typecheck reports unrelated missing symbols/properties such as recordRequest, maintenanceModeGuard, metricsRouter, dashboardSummaryService, and log.
• Failed, existing baseline: npm run lint reports unrelated existing lint errors in src/app.ts, repository tests, metrics tests, PostgresTransactionRepository.ts, and dashboard summary tests.
• Failed, existing baseline: npm test reports 32 failing tests unrelated to this branch, including maintenanceModeGuard is not defined, log is not defined, and existing credit/repository expectation drift.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[shinzoxD]

CI note: the fork push workflow is failing during the existing \
pm run typecheck\ step before this PR's OpenAPI drift gate is exercised. The logged errors are from pre-existing baseline symbols/typing issues such as \
ecordRequest\, \maintenanceModeGuard\, \dashboardSummaryService\, and \log\ in unrelated files. The PR-specific validation passes locally with \
pm run validate:openapi\ (spec validation plus the new route drift checker).

[shinzoxD]

Same pre-existing npm run typecheck baseline as #270 (27 errors, all in src/**/*.ts files this PR does not touch).

This PR's own content — the OpenAPI drift gate (scripts/check-openapi-drift.mjs), CI workflow updates, and OPENAPI.md — is unrelated to the typecheck failures. The drift gate itself passes locally (node scripts/check-openapi-drift.mjs).

The typecheck baseline fix belongs in a shared separate PR (see #270 for the full error list). This PR can be reviewed on its own merits.

[shinzoxD]

The pre-existing TypeScript baseline errors blocking CI have been fixed in #271 (fix/baseline-typescript-errors). Once that merges, this PR's CI should pass cleanly.