chore: generate frontend API contracts from the backend OpenAPI schema

[parthrohit22]

Task

Replace hand-maintained frontend API type mirrors with a deterministic generated contract from the backend's versioned OpenAPI schema.

Rationale

The audit found a live drift risk: the React client maintains TypeScript DTOs separately from FastAPI schemas. That is especially dangerous while #92 introduces versioned snapshot/query responses and #95 adds evidence-bearing proof responses. A backend contract change can otherwise compile on one side while silently misrendering or dropping evidence on the other.

References

• Backend OpenAPI generation and existing contract work in chore: OpenAPI accuracy pass across all routes #83/chore(api): complete OpenAPI accuracy pass (#83) #105.
• Frontend API mirrors under apps/frontend/src/shared/services/api/types.ts.
• feat: add versioned Repository Intelligence snapshot and query endpoints #92 and chore: deliver evidence-backed authentication architecture explanation #95 will add revision, evidence, diagnostics, and manifest fields.

Implementation Notes

• Choose one deterministic generator and pin its version.
• Generate into an explicit frontend-owned location or generate in CI; do not hand-edit generated output.
• Preserve runtime validation for untrusted responses where appropriate; generated TypeScript types alone are not runtime validation.
• Add a CI check that fails when the generated contract differs from the backend schema.

Acceptance Criteria

• Relevant frontend DTOs are generated from the backend OpenAPI document.
• A deterministic generation command is documented and reproducible in CI.
• CI fails on schema/type drift.
• Snapshot, evidence, diagnostics, and error-envelope fields are covered by contract tests.
• Auth/owner-scoped error responses remain compatible with the generated client.
• No generated artifacts contain secrets or environment-specific URLs.

Priority

P2 - Medium · Phase 0/Phase 1 reliability.

Risks and Dependencies

Coordinate with #92, #95, and #108. Do not block the security fix or the first evidence pipeline on a broad client rewrite; keep the first change limited to the contracts consumed by the proof workflow.