Release v1.10 — RSpec coverage + OpenAPI/Swagger · dripips/rubby-hrms

v1.10 — Coverage push + Public API docs + 4 prod bugfixes

RSpec went from 38 → 93 examples (smoke + 5 new suites). Writing the suites caught 4 production bugs that would have hit users.

Suite	Examples
`spec/services/icalendar_builder_spec.rb`	13 (RFC 5545: escape, fold, UTC, multi-event)
`spec/services/ai_budget_guard_spec.rb`	9 (thresholds, cache TTL, invalidate)
`spec/services/gdpr_exporter_spec.rb`	7 (JSON serializability, all 10 sections)
`spec/services/gdpr_deleter_spec.rb`	6 (anonymization, transactional atomicity)
`spec/requests/telegram_webhooks_spec.rb`	8 (secret verify, /start binding, TTL expiry, error swallowing)
`spec/requests/api/v1/openings_spec.rb`	10 (paginated list, search, show, config)

IcalendarBuilder#escape — gsub replacement special-case was halving backslashes → \ in input → \ in output → RFC 5545 violation. Moved to block-form. Would break any calendar import containing backslash.
GdprExporter — a.target_value → a.target (same bug as v1.4 dashboard widget; column never existed). DSAR export crashed for any user with KPI assignments.
GdprExporter — kpi_evaluations.comment → .notes (wrong column name).
GdprDeleter — gender: nil on employees table that is NOT NULL integer default 0 → PG::NotNullViolation rolled back the whole transaction. Users could not delete their accounts in production. Changed to gender: 0.
API routes — resources :openings produced :id param but controller read params[:code] → /api/v1/openings/JOB-0001 returned 404. Added param: :code.

public/api-docs/openapi.yaml — OpenAPI 3 spec for /api/v1/{ping,openings,openings/:code,openings/:code/apply,config}. Honeypot field, X-API-Key, multipart/form-data, pagination, search/filter parameters — all documented.
public/api-docs/index.html — interactive Swagger UI served from CDN. Try-it-out enabled.
Live at https://your-instance.com/api-docs/
README has a new "Public API" section with curl examples.