Extend OpenAPI and contract-test coverage to the remaining canonical verticals

[zachdunn]

Context

PR #839 (issue #829 §1) expanded apps/web/public/.well-known/openapi.json and added apps/api/src/openapi-contract.test.ts, which cross-checks registered routes, docs/api.md, and the OpenAPI document. Coverage was deliberately scoped to the files/usage/galleries verticals (plus the public gallery read) — the ones the narrative reference's canonical route table covers.

While running the contract test broadly, the remaining canonical verticals under /v1/workspaces/:workspace/... — github, members, storage, and billing (issue #613 phases 2–3) — were found to be absent from both openapi.json and docs/api.md. This is recorded in the contract test's module docblock.

Proposed work

• Document the github, members, storage, and billing canonical routes in openapi.json with correct statuses and schemas.
• Decide per vertical whether it belongs in docs/api.md's public route table; these are session-authed account-management surfaces, so some may warrant a separate section or an explicit exclusion.
• Widen IN_SCOPE_VERTICALS in apps/api/src/openapi-contract.test.ts as each vertical is documented, and prune the KNOWN_UNDOCUMENTED exception list.

Notes

• Additive only: no route or field renames.
• New docs pages under apps/web, if any, also need sitemap.xml and llms.txt entries.