feat: portability safeguards — signed goldens, HTTP contract suite, committed OpenAPI (Task 6)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/test_openapi_committed.py

@@ -0,0 +1,31 @@
+"""Task 6: design spec's "os 3 seguros de portabilidade", item (c) --
+"OpenAPI versionado como fonte de verdade do contrato" -- and the F2 plan's
+own requirement: `docs/openapi-v1.json` COMMITTED + a test that fails if it
+diverges from `app.openapi()`. Regenerate with:
+
+    uv run python -c "
+    import json
+    from fiscal_svc.main import app
+    with open('docs/openapi-v1.json', 'w') as f:
+        json.dump(app.openapi(), f, indent=2, sort_keys=True)
+        f.write('\n')
+    "
+
+...and commit the result -- NEVER hand-edit `docs/openapi-v1.json`."""
+import json
+from pathlib import Path
+
+from fiscal_svc.main import app
+
+_OPENAPI_PATH = Path(__file__).resolve().parents[1] / "docs" / "openapi-v1.json"
+
+
+def test_committed_openapi_matches_generated_schema():
+    committed = json.loads(_OPENAPI_PATH.read_text(encoding="utf-8"))
+    generated = app.openapi()
+
+    assert committed == generated, (
+        "docs/openapi-v1.json divergiu do schema gerado por app.openapi() -- "
+        "regenere (ver o docstring deste teste) e commite o resultado; nunca "
+        "edite o JSON à mão"
+    )