feat(api): enforce API v1 security from the spec and harden problem responses

api/openapi/components/schemas/Problem.yaml

@@ -23,11 +23,20 @@ properties:
     enum:
       - validation
       - unauthorized
+      - token_expired
       - forbidden
+      - insufficient_scope
       - not_found
       - method_not_allowed
+      - setup_complete
+      - password_managed_externally
+      - payload_too_large
+      - rate_limited
       - unavailable
       - internal
+  referenceId:
+    type: string
+    description: Present on internal errors. Quote it when reporting a problem; it tags the server's log lines for this request.
   errors:
     type: array
     description: Per-field failures. Present only when `code` is `validation`.

api/openapi/paths/openapi.yaml

@@ -4,6 +4,7 @@ json:
     x-module: core
     x-stability-level: alpha
     tags: [server]
+    security: []
     summary: Get the OpenAPI document (JSON)
     description: The bundled OpenAPI document of the running server version. Supports ETag revalidation.
     responses:
@@ -25,6 +26,7 @@ yaml:
     x-module: core
     x-stability-level: alpha
     tags: [server]
+    security: []
     summary: Get the OpenAPI document (YAML)
     description: The bundled OpenAPI document of the running server version. Supports ETag revalidation.
     responses:

api/openapi/paths/server.yaml

@@ -3,6 +3,7 @@ get:
   x-module: core
   x-stability-level: alpha
   tags: [server]
+  security: []
   summary: Describe the server
   description: |
     Returns the public server description. No authentication required.