feat(openapi): auto-generate OpenAPI spec via Fuego

[0-don]

Summary

Replace static docs/openapi/api.json and docs/openapi/relay.json with auto-generated OpenAPI spec via Fuego. Gin remains the HTTP runtime; Fuego only generates the spec at startup. Gated by ENABLE_OPENAPI=true env var (off by default).

Related: #907, #2348, #2353, #1128, #2502

This supersedes the static JSON approach from #2348/#2353. Specs are now generated from code, so they never go stale.

How it works

• 201 routes use native Fuego typed handlers; 92 remain as raw gin.HandlerFunc (relay streaming, OAuth sessions, webhooks, redirects that need raw *gin.Context)
• GinResp[T]() / GinBody[T]() annotations document raw Gin routes in the OpenAPI spec regardless
• Endpoints: GET /openapi.json (spec), GET /swagger (Scalar UI)

Changes

New dto/ package (25+ files)

• dto/router.go: wrapper providing typed route registration helpers (Get, PostB, PutB, Delete, etc.) that register in both Gin and the OpenAPI spec simultaneously
• dto/responses.go: Response[T], Ok/Fail helpers, PageData[T] for consistent typed API responses
• DTOs for all domains: channel, token, user, subscription, deployment, performance, custom_oauth, checkin, 2FA, topup, codex, etc.

Controller refactoring (all controllers)

• Refactored from raw gin.Context to Fuego typed handlers with proper request/response types
• withJSONBody() helper ensures all body-accepting routes use application/json in the spec
• GinBody[T]() annotates remaining raw Gin handlers with typed request bodies

Type reorganization

• Move shared types to types/ package to break dto > model > relay/common > dto import cycle
• channel_settings.go, user_settings.go, openai_video.go moved from dto/ to types/
• Re-exported via dto/type_aliases.go for backwards compatibility

Other

• router/openapi.go: spec serving and Scalar UI setup
• Bump Go to 1.25+, add go-fuego/fuego dependency
• model/user.go: add omitempty to Password validate tag (Fuego runs validation before handler)

Known limitations (all acceptable)

• fuegogin.Params() is a stub: all 41 call sites use dto.ParseParams[P](c) instead
• sanitizeSchemaNames does raw string replacement: no type-name collisions exist today
• Ok[T] returns *Response[T]: workaround for Go 1.25.x ICE with large generic types

Test plan

• go build ./... succeeds
• ENABLE_OPENAPI=true: /openapi.json returns valid spec, /swagger shows Scalar UI
• ENABLE_OPENAPI=false (default): routes still work, no spec served
• Existing API + relay endpoints work as before

[0-don]

Addressed remaining CodeRabbit feedback:

• encoding/json in channel.go: Migrated all 5 direct json.* calls to common.Marshal/common.Unmarshal, removed the encoding/json import entirely.
• epay userId guard: Added userId <= 0 validation in subscription_payment_epay.go before downstream operations.
• stripe nil deref: Already fixed with proper nil check on GetUserById result.
• user.go EmailBind session guard: Already safe via comma-ok type assertion pattern.
• custom_oauth raw errors: Acknowledged as a broader refactor; the pattern matches upstream code and will be addressed separately.