Contract-first API with DTOs, validation, and server-side OpenAPI post-processing

Add dedicated request/response DTOs for all controllers, replacing raw
JsonNode parameters with validated types. Move OpenAPI path-prefix stripping
and ProcessorNode children injection into OpenApiCustomizer beans so the
spec served at /api/v1/api-docs is already clean — eliminating the need for
the ui/scripts/process-openapi.mjs post-processing script.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ui/src/pages/admin/OidcAdminPage.tsx

@@ -5,8 +5,8 @@ import {
   useSaveOidcConfig,
   useTestOidcConnection,
   useDeleteOidcConfig,
-  type OidcConfigRequest,
 } from '../../api/queries/oidc-admin';
+import type { OidcAdminConfigRequest } from '../../api/types';
 import styles from './OidcAdminPage.module.css';
 
 interface FormData {
@@ -87,7 +87,7 @@ function OidcAdminForm() {
   }
 
   async function handleSave() {
-    const payload: OidcConfigRequest = {
+    const payload: OidcAdminConfigRequest = {
       ...form,
       clientSecret: secretTouched ? form.clientSecret : '********',
     };