test(backend): pin OpenAPI contract baseline (360 paths, 484 operations)

Adds tests/contracts/test_openapi_baseline.py which loads the live
FastAPI app and diffs its OpenAPI schema against a checked-in baseline.
Fails on:
  - Any removed path or operation
  - Any removed response status code on an existing operation
  - Any new required request body field (would break existing clients)

Passes silently on additive changes. The baseline is regenerated by
running tests/contracts/regenerate_baseline.py — only when a contract
change has been reviewed and every consumer (admin-compliance,
developer-portal, SDKs) has been updated in the same change set.

This is the safety harness for the Phase 1 backend-compliance refactor:
every subsequent refactor commit must keep this test green.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backend-compliance/tests/contracts/regenerate_baseline.py

@@ -0,0 +1,25 @@
+#!/usr/bin/env python3
+"""Regenerate the OpenAPI baseline.
+
+Run this ONLY when you have intentionally made an additive API change and want
+the contract test to pick up the new baseline. Removing or renaming anything is
+a breaking change and requires updating every consumer in the same change set.
+
+Usage:
+    python tests/contracts/regenerate_baseline.py
+"""
+from __future__ import annotations
+
+import json
+import sys
+from pathlib import Path
+
+THIS_DIR = Path(__file__).parent
+REPO_ROOT = THIS_DIR.parent.parent  # backend-compliance/
+sys.path.insert(0, str(REPO_ROOT))
+
+from main import app  # type: ignore[import-not-found]  # noqa: E402
+
+out = THIS_DIR / "openapi.baseline.json"
+out.write_text(json.dumps(app.openapi(), indent=2, sort_keys=True) + "\n")
+print(f"wrote {out}")