v0.6.4 — fix /openapi.json 500

Fixed

• GET /openapi.json (and therefore the /docs Swagger UI) returned a
  500 instead of the API schema. The Canvas RefillBody request model
  was defined inside create_app(), so under
  from __future__ import annotations its forward references couldn't be
  resolved at schema-generation time (request validation still worked,
  which is why nothing else surfaced it). Moved it to module scope with
  the other request-body models; added a test that renders the schema.