## Acceptance criteria - [ ] OpenAPI 3 spec for /api/* routes - [ ] Optional Swagger UI behind auth in non-prod - [ ] CI check that spec stays in sync (or generated from Zod)
Acceptance criteria