Document the expected data payloads for the TradeFlow-API integration

[AlAfiz]

Description

The frontend relies heavily on the off-chain risk engine. If the backend team changes a JSON key from risk_score to riskScore, the frontend will break. We need a documented contract.

Acceptance Criteria

• Create an API_CONTRACT.md file or set up Swagger/OpenAPI UI integration if available.
• Document the exact JSON shape expected by the frontend for the /invoices and /risk endpoints.
• Ensure the TypeScript interfaces in types/api.ts have comments linking back to this documentation.

Technical Details

• Ideally, implement a tool like Orval or RTK Query code-gen in the future to automatically generate these types from a backend OpenAPI spec.