feat(frontend): typed API client generated from the OpenAPI spec + gen-verify CI

.github/workflows/go.yml

@@ -6,6 +6,7 @@ on:
   pull_request:
     paths:
       - "backend/**"
+      - "frontend/**"
       - ".github/workflows/go.yml"
 
 permissions:
@@ -68,3 +69,42 @@ jobs:
           working-directory: backend
           # Blocking on the full ruleset: the tree is clean at zero findings, so
           # any new issue fails CI rather than being grandfathered.
+
+  # gen-verify regenerates the code-first pipeline end to end — openapi.yaml from
+  # the Go types, then the frontend TS client from that spec — and fails if the
+  # committed copies are stale. The backend drift is also covered by the apispec
+  # tests; this job additionally guards the frontend artifact, which nothing else
+  # checks (someone changing a Go contract type must run `go generate ./...` and
+  # `npm run gen:api`, then commit).
+  gen-verify:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: backend/go.mod
+          cache: false
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Generate OpenAPI from Go
+        working-directory: backend
+        run: go generate ./...
+
+      - name: Generate TypeScript from OpenAPI
+        working-directory: frontend
+        run: |
+          npm ci
+          npm run gen:api
+
+      - name: Fail on stale generated files
+        run: |
+          if ! git diff --exit-code; then
+            echo "::error::Generated files are stale. Run 'go generate ./...' in backend and 'npm run gen:api' in frontend, then commit."
+            exit 1
+          fi