fix(lit-api-server): autogenerate 429 in OpenAPI spec via CpuAvailable guard (CPL-202)

[GTC6244]

Summary

The autogenerated OpenAPI spec only showed default responses because explicit status codes were never declared at their source. The 429 on /lit_action comes from the CpuAvailable request guard, but its OpenApiFromRequest impl declared no responses — so commit #256 had to manually string-patch the 429 into the spec inside the openapi_spec binary. Fragile, and it didn't scale to other routes using the same guard.

This PR declares the 429 at its actual source:

• cpu_overload.rs — override CpuAvailable::get_responses() to declare the 429. rocket_okapi's codegen macro merges each guard's get_responses() into every operation that uses the guard, so the 429 now appears automatically on any route behind CpuAvailable, not just /lit_action.
• openapi_spec.rs — delete the manual post-processing patch; the binary now just generates and prints.

get_responses() is the idiomatic hook for this — its rocket_okapi docstring cites declaring guard responses like "401 Unauthorized" as the intended use case.

Resolves CPL-202.

Verification

• Spec output is byte-identical to main (diffed both generated specs) — so the checked-in k6 client (k6/litApiServer.ts) needs no regeneration and the openapi-spec-check CI gate stays green. The generated /lit_action responses are ["default", "429"] with the retry-backoff description intact.
• cargo +1.91 fmt --check clean.
• cargo +1.91 clippy clean (no warnings).
• All 4 cpu_overload guard tests pass, including guard_returns_429_when_overloaded.

This is a net refactor: same spec, but the 429 is now genuinely autogenerated and self-documenting at the guard rather than hardcoded in a one-off patch.

Test plan

• cargo +1.91 test -p lit-api-server --lib cpu_overload — 4 passed
• cargo +1.91 fmt --check — clean
• cargo +1.91 clippy --bin openapi_spec --lib — clean
• Generated spec diffed against main — identical

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR moves the 429 Too Many Requests OpenAPI documentation for CPU overload shedding from a brittle, endpoint-specific post-processing patch into the actual source of the behavior: the CpuAvailable Rocket request guard. This ensures any route protected by CpuAvailable automatically and consistently advertises the 429 response in the generated OpenAPI spec.

Changes:

• Added OpenApiFromRequest::get_responses() to CpuAvailable to declare a 429 response (with retry guidance) in the generated OpenAPI spec.
• Removed the manual /lit_action-specific 429 injection logic from the openapi_spec binary.
• Simplified openapi_spec.rs imports after removing the patching code.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
lit-api-server/src/core/v1/guards/cpu_overload.rs	Adds guard-level OpenAPI response metadata so 429 is autogenerated wherever CpuAvailable is used.
lit-api-server/src/bin/openapi_spec.rs	Removes manual spec mutation; binary now only generates and prints the spec.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.