chore(ci): catch OpenAPI drift via a pre-commit hook

v1.4.30 PR push failed CI on first attempt because the two new
MeasurementType enums weren't reflected in `docs/api/openapi.yaml`.
A separate `chore(openapi): regenerate the public spec` commit
was needed before the checks turned green. This hook catches the
drift at commit time locally so the contributor sees the
regeneration prompt before pushing.

New `.githooks/pre-commit`:
- Skips when no relevant files (`src/lib/openapi/`,
  `src/lib/validations/`, `src/app/api/`, the generator script
  itself) are staged.
- Runs `pnpm openapi:check` quietly; exits fast on match.
- On drift, runs `pnpm openapi:generate`, re-stages the
  regenerated `docs/api/openapi.yaml`, and continues the commit.
- Skips in CI so the existing `pnpm openapi:check` job in
  `.github/workflows/security.yml` stays the server-side
  authoritative gate.

`scripts/install-hooks.sh` flips `git config core.hooksPath` to
`.githooks/` — idempotent, one-shot per fresh clone. AGENTS.md
adds the install command to the contributor workflow section.

scripts/install-hooks.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+#
+# v1.4.31 — install the repository git hooks.
+#
+# Run once per fresh clone:
+#
+#   bash scripts/install-hooks.sh
+#
+# Idempotent. The script flips `git config core.hooksPath` to
+# `.githooks/` so every hook under that directory becomes active.
+# Currently installed: `pre-commit` (OpenAPI spec drift check).
+
+set -euo pipefail
+
+repo_root="$(git rev-parse --show-toplevel)"
+cd "$repo_root"
+
+current_path="$(git config --local --get core.hooksPath 2>/dev/null || true)"
+if [ "$current_path" = ".githooks" ]; then
+  echo "core.hooksPath already points at .githooks — nothing to do."
+  exit 0
+fi
+
+git config --local core.hooksPath .githooks
+echo "Set core.hooksPath = .githooks. Installed hooks:"
+ls -1 .githooks | grep -v '^README' | sed 's/^/  /' || true