[liyangbing]

Follow-up to #37. Fixes the hand-written API reference mismatches found in the docs audit. Every change was checked against sandbase-monorepo main (8610f216e0).

Changes

• Rate limits (guides, admin, errors, for-agents, llms-full): the only mounted request limiter is the optional per-organization RPM limit (middleware/org_ratelimit.go), which returns organization rate limit exceeded. The documented per-key and global limits (middleware/ratelimit.go) are not mounted. Also documents the daily free API limit exceeded 429 (service/free_api_quota.go; per org, per UTC day). The numeric allowance is not published.
• Volcengine native tasks: removes GET /api/v3/contents/generations/tasks (list) and DELETE …/{task_id}. The apiserver removed both in 2f8deef1b2, and only create and get are routed. The validators now assert that the removed operations stay out.
• Session create: documents inline Agents (agent without agent_id), per-Session agent overrides, and stream: true creation as a 201 SSE stream that requires an initial input. Both are live in sandbase-agents since the 2026-10-12 PROD deploy (0a41d8e811 includes 2e2b89ab38). The OpenAPI SessionCreateRequest and the OpenAI compatibility table are updated to match.
• Concurrency: the check applies to every model type on /v1/run and /v1/api/*, and only to video on other endpoints (service/org_concurrency.go).
• Errors: apiserver insufficient_scope uses a nested body; adds Agents request_too_large (413).
• OpenAI Images reference: model accepts gpt-image-2, gpt-image-2.5-flare, and gpt-image-2.5-sunburst.
• Response fields: /v1/tasks/{id}/cost pricing and /v1/upload duration_seconds. The balance example now uses trimmed decimals.

Tested

• npm run validate passes locally.

Intentionally not changed

• The /events/webhooks auth and error format (X-API-Key, {code,message}). The validators keep that path out of published pages on purpose (api-reference/webhooks.md is excluded from the build), so it needs a product decision first.
• Gold and Ultra are currently exempt from the concurrency check (concurrencyExcludedTier, marked temporary). The docs keep the published tier limits.