feat: OpenAPI docs with a Scalar reference at /docs

[leviFrosty]

Adds a public API reference: /docs (Scalar) rendering /openapi.json (OpenAPI 3.1), on prod and dev.

• Every route carries a hono-openapi describeRoute, kept in an openapi.ts beside its handlers (src/notesImport/, src/buddies/, src/accounts/, src/routePlanning/, src/openapi/coreDocs.ts). Shared helpers, the error envelope, and shared error components live in src/openapi/schemas.ts.
• Schemas describe the wire format; they don't validate. Handlers keep their own parsing, so a contract change means updating the route's openapi.ts in the same PR (noted in AGENTS.md).
• src/openapi/openapi.test.ts fails on any undocumented route, or an operation without a tag, summary, or responses.
• Signed Buddies/accounts ops document the {p, s} envelope and list the decoded p fields as a table.
• The Hono app moves to src/app.ts so tests can read its route table; src/index.ts keeps Sentry, cron, and the DO exports. No runtime behavior changes.
• Scalar's hosted AI agent, telemetry, and dev toolbar are off. The UI loads from jsDelivr. The spec is ~200 KB, built once per isolate.

Verified: tsc, 731 unit tests, wrangler deploy --dry-run (prod + dev, 582 KiB gzip), the verify loop (doctor, 38 e2e tests, fuzz:buddies 300 cases ok), and /docs rendered locally.

Doc writing turned up some contract drift between the code and docs/buddies-protocol.md (documented as the code behaves):

• suspended (403) and unknown_account (404) are missing from the protocol's error table; live close code 4003 isn't listed either.
• inbox/register also returns accountId once linked, and accepts the optional account proof.
• A wrong claimSecret on invite/claim is 401 bad_signature.
• The device/register row in the protocol's ops table is garbled.
• Notes Import App Attest too_many_challenges (429) sends no Retry-After, unlike the shared envelope's promise.

🤖 Generated with Claude Code