feat(core): serve a read-only OpenAPI reference page at /docs

[RyanLee-Dev]

Summary

Core now serves a read-only Swagger UI at GET /docs that renders the three generated contracts, and the documents themselves at GET /docs/{openapi,core.openapi,runtime.openapi}.yaml.

• contracts/agents-api/openapi.go embeds the committed openapi.yaml, core.openapi.yaml and runtime.openapi.yaml, so Core serves exactly what make openapi generated; there is no second copy.
• services/core/internal/api/openapi_docs.go registers the two routes without authentication. Only the three embedded files are served; anything else under /docs/ is 404.
• The page loads swagger-ui-dist@5.18.2 from unpkg with SRI hashes. It is read-only: no operation can be submitted (supportedSubmitMethods: []), the Authorize controls are removed so it never collects a credential, and validatorUrl: null keeps the browser from contacting the Swagger validator.
• scripts/build-core.sh adds the embedded files to Core's source set.
• docs/api/index.md and its Chinese translation describe the page. The reverse proxy does not route /docs to Core, so it is opened on Core's own address.

Compatibility

Additive only. /docs and /docs/* previously returned 404 on Core; no existing route, contract or configuration changes.

Checks

• go test ./services/core/internal/api/ ./services/core/cmd/server ./contracts/agents-api/... -count=1
• scripts/build-core.sh
• make check-docs
• website/tests/translations.test.mjs: translation coverage and freshness pass; the inline-literal check needs vitepress and is left to CI.

Made with Cursor

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}