Milestone 2: OpenAPI code generation lift (oapi-codegen + openapi-typescript)

[devin-ai-integration]

Summary

Integrates code generation from the upstream OpenAPI v1 spec (docs/openapi/stig-manager.yaml) into both the Go backend and the React frontend, and bumps the toolchain to Node 24 + Go 1.26.3 + OCI Containerfiles.

Backend (Go):

• oapi-codegen generates types.gen.go (8,451 lines — all OpenAPI models) and server.gen.go (11,198 lines — chi ServerInterface + route registration) from the upstream spec.
• The built-in api.Unimplemented type returns 501 for all 150+ operations out of the box. APIServer in internal/server/api_server.go embeds it and overrides GetAppInfo + GetConfiguration with real responses.
• Generated chi router is wired at /api/* via HandlerFromMuxWithBaseURL, replacing the Milestone 1 scaffold routes.
• New server_test.go covers /health, /api/op/appinfo, /api/op/configuration, and confirms unimplemented endpoints return 501.

Frontend (TypeScript):

• openapi-typescript generates src/lib/api/schema.ts (10,089 lines) with full path/operation/component types.
• openapi-fetch provides a type-safe apiClient (GET, POST, etc.) with autocompletion on paths and request parameters.
• fetchAppInfo migrated from raw fetch() to the typed client.

Toolchain bump:

• Node.js 22 → 24 (web + docs CI; node:24-alpine base image).
• Go 1.25.4 → 1.26.3 (api CI + go.mod toolchain directive; golang:1.26.3-alpine base image).
• api/Dockerfile → api/Containerfile, web/Dockerfile → web/Containerfile (OCI image-spec naming so Podman/Buildah build natively; Docker still builds via -f).
• Fully-qualified docker.io/library/* base image references for registry portability.

API base path fix:

• Corrected from /api/v1 to /api across all docs, README files, and code comments to match the upstream spec's server URL (http://localhost:64001/api).

CI:

• API workflow runs go generate and checks git diff --quiet to verify generated Go code is committed and up-to-date.
• Web workflow runs pnpm gen:api and checks git diff --quiet for the TS schema.
• Both workflows also trigger on docs/openapi/** changes.

Review & Testing Checklist for Human

• Verify the OCI Containerfile change works in your container runtime of choice — podman build -t stigman-api -f api/Containerfile api/ and docker build -t stigman-api -f api/Containerfile api/ should both succeed.
• cd deploy/compose && docker compose up -d --build should bring up the full stack on Node 24 / Go 1.26.3; curl http://localhost:54001/api/op/appinfo returns version JSON and curl http://localhost:54001/api/collections returns 501.
• cd api && go test ./... -race — all 5 tests pass on Go 1.26.3.
• pnpm --filter web typecheck && pnpm --filter web build and pnpm --filter docs build both succeed on Node 24.

Notes

• api.Unimplemented is oapi-codegen's built-in stub — the custom genstub generator from earlier attempts has been removed.
• Real handler implementations begin in Milestone 3 (auth integration) and Milestone 4 (database layer).
• The 1 skipped CI check is deploy preview / production (GitHub Pages deploy, only runs on main).

Link to Devin session: https://app.devin.ai/sessions/022810763c4643c0848ba894c1512b92
Requested by: @Exonical

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring