fix(api): detect OpenAPI route drift

.github/workflows/server-ci.yml

@@ -57,6 +57,12 @@ jobs:
       - name: Type-check
         run: pnpm tsc --noEmit
 
+      - name: Check generated OpenAPI document
+        run: pnpm check:openapi
+
+      - name: Check registered routes against OpenAPI
+        run: pnpm check:route-spec
+
       - name: Test
         id: tests
         continue-on-error: true
@@ -109,4 +115,4 @@ jobs:
 
       - name: Fail when tests fail
         if: steps.tests.outcome == 'failure'
-        run: exit 1
+        run: exit 1

CONTRIBUTING.md

@@ -426,6 +426,9 @@ without inspecting the URL path.
 The canonical OpenAPI 3.0 spec lives at [`docs/openapi.yaml`](./docs/openapi.yaml).
 Update it whenever you add or modify an endpoint. The spec is the contract
 between the server and all consumers (frontend, mobile, third-party integrations).
+Server CI also checks the methods and paths mounted in `server/src/routes/index.ts`
+against `server/openapi.json`; update the route operations and regenerate the JSON
+whenever a route is added, removed, or moved.
 
 ---