feat(api): add OpenAPI spec and schema validation

[cpluss]

Summary

• add in-app OpenAPI endpoints at /v1/openapi and /v1/docs
• introduce StarciteWeb.ApiSpec as the canonical HTTP contract for sessions, tail handshake, and health endpoints
• wire OpenApiSpex.Plug.CastAndValidate into SessionController for runtime schema validation
• update REST docs to document validation errors and OpenAPI discovery
• add controller tests for OpenAPI routes and schema validation failure cases

Validation

• mix precommit