Contract-first API with DTOs, validation, and server-side OpenAPI post-processing

Add dedicated request/response DTOs for all controllers, replacing raw
JsonNode parameters with validated types. Move OpenAPI path-prefix stripping
and ProcessorNode children injection into OpenApiCustomizer beans so the
spec served at /api/v1/api-docs is already clean — eliminating the need for
the ui/scripts/process-openapi.mjs post-processing script.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ui/src/auth/LoginPage.tsx

@@ -1,7 +1,7 @@
 import { type FormEvent, useEffect, useState } from 'react';
 import { Navigate } from 'react-router';
 import { useAuthStore } from './auth-store';
-import { config } from '../config';
+import { api } from '../api/client';
 import styles from './LoginPage.module.css';
 
 interface OidcInfo {
@@ -17,9 +17,8 @@ export function LoginPage() {
   const [oidcLoading, setOidcLoading] = useState(false);
 
   useEffect(() => {
-    fetch(`${config.apiBaseUrl}/auth/oidc/config`)
-      .then((res) => (res.ok ? res.json() : null))
-      .then((data) => {
+    api.GET('/auth/oidc/config')
+      .then(({ data }) => {
         if (data?.authorizationEndpoint && data?.clientId) {
           setOidc({ clientId: data.clientId, authorizationEndpoint: data.authorizationEndpoint });
           if (data.endSessionEndpoint) {