ci(openapi): hard-fail on spec drift (was warn-only)

The Security & Quality workflow ran the OpenAPI drift check with
`continue-on-error: true` since v1.4.23 while the Zod registry caught
up with the hand-maintained legacy spec. Coverage is now complete and
the v1.5 iOS Swift codegen needs the contract pinned, so the gate
flips to hard-fail: any route signature change without a regenerated
`docs/api/openapi.yaml` blocks the merge.

The CI error message points at `pnpm openapi:generate` and the
registry under src/lib/openapi/ so the fix is self-evident.

.github/workflows/security.yml

@@ -41,20 +41,18 @@ jobs:
       - name: Unit tests
         run: pnpm test
 
-      # v1.4.23 W4 F5c — OpenAPI spec drift check.
+      # OpenAPI spec drift gate — hard-fail (flipped from warn-only in v1.4.25).
       #
-      # `continue-on-error: true` is intentional for v1.4.23: the
-      # registry covers only the iOS-touched routes today, and the
-      # legacy hand-maintained spec at docs/api/openapi-v1422-legacy.yaml
-      # carries the rest. Once the registry hits ~95% coverage in
-      # v1.4.24+, flip this to a hard gate by removing
-      # `continue-on-error`.
+      # The Zod registry is the source of truth for the public API contract.
+      # Any route signature change must be reflected in `docs/api/openapi.yaml`
+      # so downstream consumers (notably the v1.5 iOS Swift codegen) stay in
+      # lockstep. If this step fails, run `pnpm openapi:generate` locally and
+      # commit the regenerated spec.
       - name: OpenAPI spec drift check
-        continue-on-error: true
         run: |
           pnpm openapi:generate
           if ! git diff --exit-code docs/api/openapi.yaml; then
-            echo "::warning::OpenAPI spec out of date. Run 'pnpm openapi:generate' locally and commit the changes."
+            echo "::error::OpenAPI drift detected — regenerate the spec via 'pnpm openapi:generate' and commit the result. The Zod registry under src/lib/openapi/ is the source of truth for the public API contract."
             exit 1
           fi
           echo "::notice::OpenAPI spec in sync with Zod source schemas."

scripts/check-openapi.ts

@@ -3,9 +3,9 @@
  * Compare the freshly-generated OpenAPI spec against the committed
  * `docs/api/openapi.yaml`. Exits non-zero on drift.
  *
- * Used by the CI gate in `.github/workflows/security.yml`. v1.4.23 runs
- * the step with `continue-on-error: true` while the registry catches
- * up with the hand-maintained spec; v1.4.24+ flips it to hard-fail.
+ * Used by the CI gate in `.github/workflows/security.yml`. Hard-fails on
+ * drift since v1.4.25 — the Zod registry is the source of truth for the
+ * public API contract that the v1.5 iOS Swift codegen consumes.
  */
 import { readFileSync } from "node:fs";
 import { resolve } from "node:path";