Fix duplicate status keys in the new OpenAPI response blocks

`stdResponses` already carries 401, 422 and 429. The three response
blocks added with the measurements:write scope each declared their own
422 (and, on the mint route, a 429) BEFORE spreading it, so the generic
wording overwrote the specific wording and TypeScript refused the
duplicate key. The build failed at auth.ts with "'422' is specified more
than once".

Move the explicit keys after the spread, which is what the MCP mint next
door already does and the only order in which a per-route description
survives.

Worth stating because the failure mode is quiet: had TypeScript allowed
it, the published contract would simply have carried "Request validation
failed" everywhere instead of naming
measurement.create.source_not_permitted and its siblings.

src/lib/openapi/routes/auth.ts

@@ -1656,6 +1656,10 @@ export const authPaths: NonNullable<ZodOpenApiObject["paths"]> = {
           description: "Content-Type is not `application/json`.",
           content: { "application/json": { schema: errorEnvelope } },
         },
+        // After the spread, not before: `stdResponses` carries its own 422 and
+        // 429, and a key placed ahead of it is silently overwritten by the
+        // generic wording. Same ordering as the MCP mint next door.
+        ...stdResponses,
         "422": {
           description:
             "Validation failed. The envelope carries every offending issue, not just the first.",
@@ -1666,7 +1670,6 @@ export const authPaths: NonNullable<ZodOpenApiObject["paths"]> = {
             "More than 10 mints from this account in a minute. Nothing was minted.",
           content: { "application/json": { schema: errorEnvelope } },
         },
-        ...stdResponses,
       },
     },
   },

src/lib/openapi/routes/measurements.ts

@@ -876,12 +876,14 @@ export const measurementPaths: NonNullable<ZodOpenApiObject["paths"]> = {
             "A measurement with this data already exists — the `(userId, type, source, externalId)` dedup index rejected the write.",
           content: { "application/json": { schema: errorEnvelope } },
         },
+        // After the spread: `stdResponses` carries a generic 422 that would
+        // otherwise overwrite this one.
+        ...stdResponses,
         "422": {
           description:
             "Validation failed, or (`measurement.create.source_not_permitted`) a narrow `measurements:write` credential named `APPLE_HEALTH` as the source. Refused rather than relabelled, so the caller can fix the payload instead of discovering rows it did not ask for.",
           content: { "application/json": { schema: errorEnvelope } },
         },
-        ...stdResponses,
       },
     },
   },
@@ -996,12 +998,14 @@ export const measurementPaths: NonNullable<ZodOpenApiObject["paths"]> = {
             },
           },
         },
+        // After the spread: `stdResponses` carries a generic 422 that would
+        // otherwise overwrite this one.
+        ...stdResponses,
         "422": {
           description:
             "The batch exceeded the 500-entry limit (`measurement.batch.too_large`), failed validation, or (`measurement.batch.source_not_permitted`) carried an entry naming `APPLE_HEALTH` under a narrow `measurements:write` credential. Nothing was written in any of the three cases.",
           content: { "application/json": { schema: errorEnvelope } },
         },
-        ...stdResponses,
       },
     },
   },