feat(web): publish accurate offline OpenAPI contracts (v26.09.12)

[ancongui]

Manual Request -> JSONResponse handlers currently omit their body/response contract, and typed handlers lose unions, parameter constraints and mapping names. Add documentation-only operation metadata and shared Pydantic schema generation so both styles can export accurate OpenAPI without changing request binding or response dispatch.

• Public openapi_operation, operation/body/parameter/response/header declarations and framework-neutral RouteMetadata support offline export with base dependencies. Explicit response statuses, content, headers, optional bodies and security overrides describe manual contracts while preserving the callable/signature.
• Generate validation/serialization schemas with aliases, constraints, unions, containers, recursion and collision-safe references/discriminator mappings; accept TypeAdapters and custom GenerateJsonSchema subclasses.
• Respect explicit IDs/mapping names, qualify inferred collisions deterministically and reject duplicate explicit IDs or controller path/methods. Inspect controller methods without evaluating descriptors. Inject a custom generator into create_app for the served document.
• Document override/compatibility semantics and prepare CalVer 26.9.12 / v26.09.12. OpenAPI security describes the contract and does not apply authorization. Runtime binder type support remains unchanged.

Validation:

• Reproduced original omissions from the downloaded 26.9.11 wheel in a clean environment with networking blocked.
• 105 focused OpenAPI/CLI tests pass, including 43 new contract cases and the None-only parameter review fix. Full local suite before that final one-line fix: 7,762 passed, 7 skipped, 2,573 deselected; final full coverage runs in CI.
• Ruff lint/format and strict mypy pass (784 source files). MkDocs strict build, six book tests and both manuscript syntax checks pass. Wheel/sdist build succeeds.
• Clean noneditable local wheel passes base-only offline imports, references/discriminators, schema modes/aliases, deterministic generation, explicit responses, real in-memory manual dispatch and independent OpenAPI 3.1 validation, with network denied.
• Independent whole-branch review found no Critical/Important issues. Its sole Minor parameter-requiredness finding is corrected and tested.

CI covers supported Python/SQLAlchemy versions and browser/distribution gates. Real-backend Docker lanes remain nightly/manual per repository policy; no shared local services were used. Downloaded release wheel/sdist will be independently hashed and installed after publication.