Wire RestAPI OBS3004 path validation and OBS3005 on R3

[Skymly]

Summary

• Validate HTTP path {placeholder} names against method parameters (OBS3004)
• R3 generator emits OBS3005 when interface uses IObservable<T>

Test plan

• GetUser_path_parameter_mismatch_reports_OBS3004 generator test
• CI build-test + pack

Closes #60

---

Note

Low Risk
Compile-time generator diagnostics only; no runtime API or auth changes.

Overview
The RestAPI source generator now validates HTTP route paths on attributed methods: {placeholder} segments must match the method’s parameters exactly (excluding CancellationToken), or it reports OBS3004.

For the R3 generator flavor, IObservable<T> on an interface now emits OBS3005 (SystemReactiveNotReferenced) instead of the generic unsupported-return diagnostic, steering users toward the Reactive package.

A generator test asserts OBS3004 when the path has {id} but the method has extra parameters.

^{Reviewed by Cursor Bugbot for commit c733b28. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is ON, but it could not run because the branch was deleted or merged before autofix could start.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit c733b28. Configure here.}

[cursor]

Path validation rejects valid APIs

High Severity

ValidatePathTemplate treats path {placeholder} names and method parameters as sets that must match exactly via SetEquals, counting every parameter except CancellationToken by parameter.Name. The RestAPI runtime in RestMethodInfoInternal still binds extra parameters as query values, body/header/property parameters via attributes, and path tokens using AliasAs with case-insensitive names—so many interfaces that compile and run today will now fail with OBS3004.

 

^{Reviewed by Cursor Bugbot for commit c733b28. Configure here.}