docs: publish API and operations guidance

[fabiorosa]

Closes #25

What changed

• publishes the OpenAPI 3.1 contract for every public Fastify route
• updates clone-clean local setup and the product's current capability statement
• adds a private vulnerability-reporting policy and explicit security boundaries
• adds a pre-deployment runbook with process roles, migration order, health checks, and rollback limits
• adds a route-presence regression test and records ADR-018

Why

The product behavior is now substantial enough that reviewers need a stable API and operational boundary before a public demo is deployed. These documents describe observable behavior and limitations without inventing a hosted service or uptime claim.

Validation

• formatting, lint, typecheck, and build pass
• 53 unit and HTTP tests pass
• 24 PostgreSQL, Redis, worker, and HTTP integrations pass
• all 11 Chromium assertions pass locally

Local Windows note

Playwright completes all assertions, but its managed web-server teardown can exceed the Windows command timeout. The GitHub Actions Quality runs are the terminal process-exit gate.