fix(api): validate discovery routes against published schemas

[andriypolanski]

Summary

• Derive FindOpportunitiesRequestSchema / IssueRagRetrieveRequestSchema from @loopover/contract's FindOpportunitiesInput / RetrieveIssueContextInput (single source for MCP, REST, OpenAPI).
• Parse both discovery route bodies with those schemas before the hand-rolled validators; map schema failures onto the existing invalid_request + reason shapes.
• Add .min(1) on RetrieveIssueContextInput owner/repo/title; stop silent truncation of over-long labels/body; document the cross-field targets/searchQuery rule on the OpenAPI operation.

Test plan

• npx vitest run test/unit/find-opportunities.test.ts test/unit/mcp-issue-rag.test.ts test/unit/mcp-find-opportunities.test.ts test/unit/contract-registry.test.ts test/unit/openapi.test.ts
• npx vitest run test/integration/api.test.ts -t "REGRESSION: discovery routes"
• npm run ui:openapi

Fixes #10040

[loopover-orb]

Important

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏳ LoopOver is waiting…

LoopOver has seen this pull request and is waiting on CI checks to finish before reviewing it. This comment will update once the review runs.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed · 🟨 Waiting}

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

❌ 3 Tests Failed:

Tests completed	Failed	Passed	Skipped
2596	3	2593	0

View the top 3 failed test(s) by shortest run time

test/unit/issue-rag-mcp.test.ts > runIssueRagRetrieval (#4293) > covers validation branches for owner/title/body/labels/topK normalization

Stack Traces | 0.00213s run time

AssertionError: expected { ok: true, …(1) } to match object { ok: false, reason: 'title_too_long' }
(5 matching properties omitted from actual)

- Expected
+ Received

  {
-   "ok": false,
-   "reason": "title_too_long",
+   "ok": true,
  }

 ❯ test/unit/issue-rag-mcp.test.ts:50:7

test/unit/issue-rag-mcp.test.ts > runIssueRagRetrieval (#4293) > rejects oversized repos and invalid labels

Stack Traces | 0.013s run time

AssertionError: expected { ok: true, …(1) } to match object { ok: false, reason: 'repo_too_long' }
(5 matching properties omitted from actual)

- Expected
+ Received

  {
-   "ok": false,
-   "reason": "repo_too_long",
+   "ok": true,
  }

 ❯ test/unit/issue-rag-mcp.test.ts:25:154

test/unit/routes-issue-rag.test.ts > issue-rag retrieve route (#4293) > rejects invalid requests and malformed JSON bodies

Stack Traces | 0.0432s run time

AssertionError: expected { status: 'invalid_request', …(3) } to match object { status: 'invalid_request', …(1) }
(5 matching properties omitted from actual)

- Expected
+ Received

  {
-   "reason": "title_required",
+   "reason": "invalid_body",
    "status": "invalid_request",
  }

 ❯ test/unit/routes-issue-rag.test.ts:74:33

To view more test analytics, go to the Test Analytics Dashboard
_{📋 Got 3 mins? Take this short survey to help us improve Test Analytics.}

[loopover-orb]

This repository reviews pull requests one-shot: the PR must be correct as originally opened. Pushing an additional commit closes it automatically instead of restarting review — open a fresh pull request with every fix included.