Publish examples and query parameters, and stop the harvest leaking secrets

The spec described 573 operations with a schema each and almost nothing a
reader could copy: 12 operations carried an example, and no operation described
a query parameter at all, because a Flask handler's query string is invisible to
url_map. A route whose real interface is ?code= documented nothing.

Both are now derived from evidence rather than written by hand.

QUERY PARAMETERS come from each view's AST - request.args.get, the subscript
form, getlist, and this repo's own helpers - and a read that does not resolve to
a literal name is not emitted. 0 to 87 operations, 350 parameter objects. The
enumerations some handlers validate (sort=assetnumber|hostname) are deliberately
NOT published: deriving the accepted set reliably needs more than a literal
read, and a wrong enum is exactly the invented contract this work avoids.

EXAMPLES are harvested from the test suite, which already sends real bodies and
asserts real responses, so they are transcripts rather than inventions. 12 to
about 324. The harvest is re-runnable and optional; generation works without it.

THE HARVEST PUBLISHED TWO REAL CREDENTIALS, and that is the important part of
this commit. A bootstrap token and a kiosk setup code reached docs/openapi.json
inside URL values - a file served at /api/docs on production and copied to a
wiki. Neither scrubber layer could see them: the keys are 'scripturl' and 'url',
which name no secret, and the opaque-value rule excludes ':' and '/' on purpose
so that example URLs survive. Nothing was committed.

Four changes came out of it:

- a URL-credential rule that scrubs the parameter VALUE and keeps the URL, so
  ?t= is redacted and ?page=2&perpage=50 still reads as an example
- redaction runs on the way OUT as well as on the way in. Harvested examples
  live in the inventory and a refresh preserves them, so a scrubber fixed after
  a harvest protects only future harvests while the stored copy keeps
  publishing. The published file can no longer carry a secret the current rules
  would catch, whatever the inventory holds
- the leak gate now holds its own patterns instead of importing the generator's.
  Checked with the scrubber's own rules it could only ever assert that redact()
  ran, and it was green while both tokens sat in the file. It now knows the
  product's token prefixes, a URL-credential shape, and a crude entropy
  backstop. Replanting the exact credential that shipped fails it
- a DELETE only declares a body when the HANDLER reads one, derived from its
  AST. A transcript proves the client sent something: the suite posts {} to
  routes that ignore it, and that published "this route reads a JSON body" on
  DELETE /api/endpoints/agentkey, whose handler never calls get_json.

249 operations still carry no example, because no test exercises them with a
JSON body. The honest fix is a test, not a hand-written example, and the next
harvest picks each one up for free.

tests/test_api_inventory_parity.py

@@ -183,3 +183,63 @@ def test_documented_auth_is_what_the_code_enforces():
         'inventory is derived, so fix the code or teach the classifier in '
         'scripts/gen_openapi.py, then re-run it with --refresh:\n  %s'
         % (len(disagreements), '\n  '.join(disagreements[:15])))
+
+
+# ---------------------------------------------------------------------------
+# The third derived field: query parameters
+# ---------------------------------------------------------------------------
+#
+# A Flask rule carries its path arguments and nothing else, so a route whose
+# real interface is '?code=' or '?search=' documented no parameters at all -
+# /api/usb/kiosk/setup among them, where '?code=' is the ONLY way to call it
+# successfully. gen_openapi.py now reads them out of each view's AST and writes
+# them into the inventory as `queryparams`.
+#
+# That field is DERIVED, like auth, and gated the same way and for the same
+# reason: a refresh only rewrites, so without a comparison a hand-edit or a
+# stale file publishes a query contract the handler does not implement. A
+# parameter that is not really there is the worst kind of documentation defect,
+# because a reader believes it, sends it, and is silently ignored.
+
+
+def derived_queryparams():
+    """{(METHOD, path): [parameter, ...]} as the sweep reads the code now."""
+    generator = _generator()
+    app = create_app('testing')
+    derived = {}
+    for rule, methods, endpoint, view in generator._served_routes(app):
+        parameters = generator._query_parameters(view)
+        for method in methods:
+            derived[(method, normalise(rule))] = parameters
+    return derived
+
+
+def documented_queryparams():
+    """{(METHOD, path): [parameter, ...]} as the inventory has it committed."""
+    documented = {}
+    for surface in json.loads(INVENTORY.read_text()):
+        for entry in surface.get('endpoints', []):
+            path = normalise(entry.get('path') or '')
+            for method in re.split(r'[/,|]', entry.get('method') or 'GET'):
+                method = method.strip().upper()
+                if method:
+                    documented[(method, path)] = entry.get('queryparams') or []
+    return documented
+
+
+def test_documented_query_parameters_are_what_the_handler_reads():
+    derived = derived_queryparams()
+    documented = documented_queryparams()
+    disagreements = []
+    for key in sorted(set(derived) & set(documented)):
+        if derived[key] != documented[key]:
+            disagreements.append(
+                '%s %s\n      documented: %s\n      read:       %s'
+                % (key[0], key[1],
+                   [item['name'] for item in documented[key]],
+                   [item['name'] for item in derived[key]]))
+    assert not disagreements, (
+        '%d route(s) document query parameters that are not what the handler '
+        'reads. The field is derived, so regenerate with '
+        'scripts/gen_openapi.py --refresh:\n  %s'
+        % (len(disagreements), '\n  '.join(disagreements[:15])))