[#904] Enforce generated OpenAPI drift checks

[mikewheeleer]

Summary

• Make the checked-in openapi.yaml reproducible from the registered OpenAPI builder.
• Extend openapi:check to fail on generated-artifact drift.
• Validate representative cursor/limit pagination and validation-error contracts.
• Validate that bearer-protected operations document an authentication error response.
• Document the impersonation route in the route inventory and add the missing leaderboard pagination validation response.
• Run the OpenAPI check as a required CI step.

Acceptance criteria

• Generated output is reproducible: the checker compares the checked-in YAML with fresh deterministic generation.
• CI detects uncommitted drift: npm run openapi:check is a required workflow step.
• Error and pagination schemas are tested for representative user/prediction list contracts.
• Authentication and validation constraints are checked for protected operations and pagination inputs.

Validation

• npm run openapi:generate — passed
• npm run openapi:check — passed
• git diff --check — passed
• npm run build — blocked by pre-existing syntax errors in src/routes/users.ts (lines 330, 332, 340, 385, 388), outside this PR.

Security and compatibility

This adds validation and documentation gates without changing request handling. The checker fails closed on route drift, stale artifacts, missing pagination validation, or missing auth error documentation. Rollback is a revert of the CI step and checker extensions.

Closes #904