feat(api): M4.2 — REST surface + pgx Postgres store + OpenAPI 3.1

Full M4.2 deliverable: 16 endpoints (tenants CRUD + lifecycle, catalog, entitlements, API keys with argon2 hashing, audit append + filter), Store interface with pgx-backed Postgres + in-memory parallel implementations exercised by the same eachStore harness, openapi.yaml at 3.1 with kin-openapi contract test. M4.3 adds auth.

Refs: M4.2

internal/server/openapi_helpers_test.go

@@ -0,0 +1,15 @@
+package server_test
+
+import (
+	"net/http"
+	"testing"
+)
+
+func newRequest(t *testing.T, method, path string) *http.Request {
+	t.Helper()
+	req, err := http.NewRequest(method, "http://test"+path, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return req
+}