Epic: what the API owes the console now that barakoBrew is an external consumer

Counterpart to BaryoDev/barakoBrew#19. That epic covers what the console lost in the split. This one covers what the API still owes it.

**#505 was executed cleanly on this side.** The changelog fragment is honest and complete, the Dependabot `/admin` and `/site` entries are gone, no workflow still references `admin/Dockerfile`, the README says plainly "This repository has no front end", and `assets/admin` was removed. Nothing here is debris.

The gap is not tidiness. It is that **the split turned an internal call into a public contract, and nothing was promoted to match.**

## The shape of it

While the console lived in `admin/`, an endpoint's request and response records could change in the same commit as the screen that read them. That is why `CLAUDE.md` §6 puts `Features/*` out of scope for the stability rule, and marks it `internal`:

> The endpoints, their `Request` and `Response` records, and their validators are how this host implements the API, not something another assembly compiles against.

That reasoning was correct on 4 September and is wrong on 6 September. barakoBrew compiles against nothing, but it *consumes* those records over HTTP, from a separate repository, on a separate release cadence, with no commit able to span both. The HTTP envelope is now the contract — and it is the one surface the stability policy explicitly excludes.

This is not hypothetical. The envelope change that started returning `items` where the console read `versions` rendered an empty list rather than failing, and every mocked spec on the console side stayed green because the mock returned `versions` too. That happened while both lived in one repo and could be fixed in one commit. Now they cannot.

## What is already planned and adjacent

Roadmap 3.27.0 carries #183, #186 and #187 — a typed .NET client and a job that fails when the generated client stops matching the API. **#187's machinery is exactly what the console needs**, but its scope is a .NET client for MAUI and Blazor consumers. barakoBrew is TypeScript, consumes the HTTP surface directly, and has no generated client, so it is not covered. The fix is to widen that job, not to build a second one.

## The work

- [ ] The HTTP surface needs a stability policy, since §6 excludes it
- [ ] Nothing here notices when an API change breaks the console — extend #187 to diff the OpenAPI document itself
- [ ] The issue template sends console bugs to a chooser that does not exist
- [ ] This repo promises an image barakoBrew cannot currently publish

## Related on the console side

BaryoDev/barakoBrew#19 (repo at par), #31 (the unmocked contract pack, currently unrunnable — `scripts/smoke-check.sh` went to neither repo), #26 (making that pack a required check so the two stay in sync), #1 (`RUN_STATUSES` has no check against the server enum since the split), and #614 here (`CITATIONS.cff` licence contradiction, found while auditing the console's licensing).