chore(ci): guard committed openapi.json against drift

[pparage]

Nothing regenerates or verifies the committed root openapi.json, so it rots silently. It had drifted all the way back to the pre-v1 API — 84 paths, zero /v1 — while README.md states it is what bootstraps the Kong gateway config. #115 regenerated it (84 → 121 paths) and #113 regenerated it again after route removals (116 → 86), but nothing stops the next drift.

Why it went unnoticed: no test reads the file. tests/test_api_smoke.py, tests/test_routes_registered.py and the Dockerfile healthcheck all hit the live /docs/openapi.json; tests/fixtures/routes_golden.json covers registered routes, not the committed artifact. There is no .pre-commit-config.yaml.

Proposal

Mirror the existing generated.py gate in .github/workflows/schema-and-operators.yml:

- name: OpenAPI drift check
  working-directory: range42-backend-api
  run: |
    . .venv/bin/activate
    PROJECT_ROOT_DIR=$PWD API_BACKEND_WWWAPP_PLAYBOOKS_DIR=$PWD \
    API_BACKEND_PUBLIC_PLAYBOOKS_DIR=$PWD API_BACKEND_INVENTORY_DIR=$PWD/inventory \
    PYTHONPATH=. python -c "import json; from app.main import create_app; print(json.dumps(create_app().openapi(), indent=2))" > /tmp/openapi.check.json
    diff -q openapi.json /tmp/openapi.check.json \
      || { echo "::error::openapi.json is out of date — regenerate and commit"; exit 1; }

Generation is verified deterministic and env-independent (same md5 from a different cwd with bogus paths), so this is safe as a hard gate. Note it will start failing any PR that changes routes without regenerating — that is the point, but worth flagging before it lands.

Related cleanups

• README.md:142-150 documents the regeneration recipe but it is not runnable verbatim — without the env vars it dies at import time (PROJECT_ROOT_DIR is read at module scope). The config table also claims PROJECT_ROOT_DIR defaults to ., which is false.
• range42-api-definitions still publishes all the routes removed in Bundle rename alignment: dotted names, generic/ tier, proxmox decom #113 (8 bundle paths, 6 vm_ids/*, plus an orphaned vm_ids request component) and its README hardcodes a now-wrong route count. If that repo is dead, archiving it is cleaner than letting it publish a fictional API.

[pparage]

Closed by #134.