feat(frontend): typed API client generated from the OpenAPI spec + gen-verify CI

The code-first OpenAPI generator landed on main (covering projects + sessions),
superseding this branch's backend work. This repurposes the PR to the parts main
still lacks:

- frontend/src/api/schema.d.ts — generated from backend/internal/httpd/apispec/
  openapi.yaml via openapi-typescript (`npm run gen:api`); covers projects,
  sessions, and orchestrators.
- frontend/src/api/client.ts — a small openapi-fetch client typed by that schema,
  so the renderer's request/response types come from the daemon contract instead
  of being hand-maintained.
- CI gen-verify job — regenerates the spec from Go and the TS client from the
  spec, failing if either committed artifact is stale. Backend drift is also
  covered by the apispec tests; this additionally guards the frontend artifact,
  which nothing else checks.

Frontend typecheck passes; the gen pipeline reproduces the committed files with
no drift.

Author: i-trytoohard

.github/workflows/go.yml

@@ -6,6 +6,7 @@ on:
   pull_request:
     paths:
       - "backend/**"
+      - "frontend/**"
       - ".github/workflows/go.yml"
 
 permissions:
@@ -68,3 +69,42 @@ jobs:
           working-directory: backend
           # Blocking on the full ruleset: the tree is clean at zero findings, so
           # any new issue fails CI rather than being grandfathered.
+
+  # gen-verify regenerates the code-first pipeline end to end — openapi.yaml from
+  # the Go types, then the frontend TS client from that spec — and fails if the
+  # committed copies are stale. The backend drift is also covered by the apispec
+  # tests; this job additionally guards the frontend artifact, which nothing else
+  # checks (someone changing a Go contract type must run `go generate ./...` and
+  # `npm run gen:api`, then commit).
+  gen-verify:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: backend/go.mod
+          cache: false
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Generate OpenAPI from Go
+        working-directory: backend
+        run: go generate ./...
+
+      - name: Generate TypeScript from OpenAPI
+        working-directory: frontend
+        run: |
+          npm ci
+          npm run gen:api
+
+      - name: Fail on stale generated files
+        run: |
+          if ! git diff --exit-code; then
+            echo "::error::Generated files are stale. Run 'go generate ./...' in backend and 'npm run gen:api' in frontend, then commit."
+            exit 1
+          fi